CVE-2026-55880 Overview
CVE-2026-55880 is an authorization flaw in OpenReplay, a self-hosted session replay suite. Versions 1.27.0 and earlier ship three mutation functions that execute SQL without an ownership predicate. The notes.delete function filters only on note ID and project ID, while dashboards.update_widget and dashboards.remove_widget filter only on dashboard ID and widget ID. Any authenticated project member can delete another user's private session notes and modify or remove widgets on another user's private dashboards. The issue is classified under [CWE-639: Authorization Bypass Through User-Controlled Key].
Critical Impact
Authenticated members of an OpenReplay project can tamper with or destroy private notes and dashboard widgets belonging to other users in the same tenant.
Affected Products
- OpenReplay session replay suite version 1.27.0
- OpenReplay session replay suite versions prior to 1.27.0
- Self-hosted OpenReplay deployments exposing dashboard and note APIs
Discovery Timeline
- 2026-07-10 - CVE-2026-55880 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-55880
Vulnerability Analysis
OpenReplay exposes dashboard and note operations through backend functions that translate API calls into SQL statements. The read and edit variants of these functions enforce an ownership predicate that ties the row to the requesting user. The three affected mutation functions omit that predicate. notes.delete scopes its WHERE clause to note ID and project ID only. dashboards.update_widget and dashboards.remove_widget scope their queries to dashboard ID and widget ID only.
Any authenticated user who belongs to the same project can supply an identifier for a resource owned by another user. The database returns and modifies that row because no user-scoped column participates in the filter. Confidentiality of private records is preserved, but integrity and availability of notes and dashboard widgets are lost across the project boundary.
Root Cause
The root cause is inconsistent authorization between sibling functions in the same module. Read and edit paths include an ownership check in their SQL, but the delete and widget mutation paths do not. The application relies on client-supplied identifiers without verifying that the authenticated principal owns the referenced private resource.
Attack Vector
Exploitation requires an authenticated account with membership in the target project. The attacker calls the vulnerable mutation endpoints with the target user's note ID, dashboard ID, or widget ID. No user interaction from the victim is required. The attack is network-reachable against any OpenReplay instance where multiple users share a project. Refer to the GitHub Security Advisory GHSA-9xfv-p2fx-vmx9 for the maintainers' technical description.
Detection Methods for CVE-2026-55880
Indicators of Compromise
- Unexpected deletions of private session notes reported by users who did not initiate the action.
- Private dashboards showing widgets that were removed, added, or altered without the owner's knowledge.
- API access logs showing notes.delete, dashboards.update_widget, or dashboards.remove_widget calls where the requesting user does not match the resource owner.
Detection Strategies
- Correlate PostgreSQL audit logs for UPDATE and DELETE statements against the notes and dashboard widgets tables with the authenticated user ID from application logs.
- Alert on any mutation to a private note or private dashboard widget where the acting principal differs from the row owner.
- Baseline per-user rates of note deletion and widget modification and flag statistical outliers.
Monitoring Recommendations
- Ingest OpenReplay application and database logs into a centralized analytics platform such as Singularity Data Lake to run cross-source queries on ownership mismatches.
- Retain HTTP request bodies for dashboard and note mutation endpoints long enough to reconstruct which resources were targeted.
- Monitor authentication logs for accounts that recently accessed multiple users' resources within a short window.
How to Mitigate CVE-2026-55880
Immediate Actions Required
- Upgrade OpenReplay to a release later than 1.27.0 that adds the ownership predicate to the affected functions.
- Audit notes, dashboards, and dashboard_widgets tables for unauthorized deletions or modifications since deployment.
- Restrict project membership to trusted users until the patched version is deployed.
- Rotate session tokens for accounts suspected of abusing the vulnerable endpoints.
Patch Information
The maintainers documented the fix in the OpenReplay GitHub Security Advisory GHSA-9xfv-p2fx-vmx9. The fix adds the missing ownership predicate to notes.delete, dashboards.update_widget, and dashboards.remove_widget so that the SQL statements only affect rows owned by the requesting user.
Workarounds
- Limit project membership to a single trusted user per project until upgrading.
- Place OpenReplay behind an API gateway that inspects mutation requests and validates the requester against the resource owner.
- Enable database-level row access policies to enforce ownership independently of the application layer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
