CVE-2026-77768 Overview
CVE-2026-77768 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in Openpanel, an open-source analytics platform. The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportById(reportId) without evaluating project membership. The enforceAccess middleware in packages/trpc/src/trpc.ts inspects membership only when the input carries a projectId or organizationId key. Because a bare reportId bypassed that check, any authenticated user could read the full configuration of any saved report on the instance.
Critical Impact
Authenticated users can retrieve any report's owning projectId, event series, filters, breakdowns, and formulas by supplying its identifier, exposing cross-tenant analytics configuration.
Affected Products
- Openpanel (self-hosted analytics platform)
- packages/trpc router module containing the report.get procedure
- Instances running commit e8a0602cda5a4d4b463f11d298a1b078c446bf33 and earlier
Discovery Timeline
- 2026-08-21 - CVE-2026-77768 published to NVD
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-77768
Vulnerability Analysis
The defect is a missing authorization check on a tRPC query procedure. The report.get procedure accepted a reportId input and forwarded it directly to getReportById(reportId) in packages/db/src/services/reports.service.ts. That function performs a Prisma findUnique on the report identifier with no project scoping applied.
The enforceAccess middleware evaluates membership only when the input schema includes a projectId or organizationId key. A request containing only a reportId passed the middleware unchecked. Adjacent update, delete, and duplicate procedures resolved the report first and then called getProjectAccess against the report's own projectId, so the omission was specific to this read path.
Root Cause
The access-control model conditions enforcement on input shape rather than on the resource being accessed. When a procedure accepts an identifier that resolves to a tenant-scoped object, the middleware has no signal to trigger membership evaluation, resulting in a broken access control pattern classified as [CWE-639].
Attack Vector
An authenticated user on the same instance invokes the report.get tRPC endpoint over the network with any known or guessed reportId. The server returns the full report record, including the owning projectId, event series, filters, breakdowns, and formulas belonging to other projects or organizations.
// Security patch in packages/trpc/src/routers/report.ts
import { z } from 'zod';
-import { db, getReportById, getReportsByDashboardId } from '@openpanel/db';
+import {
+ db,
+ getDashboardById,
+ getReportById,
+ getReportsByDashboardId,
+} from '@openpanel/db';
import { zReport } from '@openpanel/validation';
import { getProjectAccess } from '../access';
-import { TRPCForbiddenError } from '../errors';
+import { TRPCForbiddenError, TRPCNotFoundError } from '../errors';
import { createTRPCRouter, protectedProcedure } from '../trpc';
export const reportRouter = createTRPCRouter({
Source: Openpanel GitHub Commit 0a51b68
Detection Methods for CVE-2026-77768
Indicators of Compromise
- tRPC requests to report.get where the responding report's projectId does not match a project the requesting user is a member of.
- Elevated volume of report.get calls from a single authenticated session enumerating sequential or random report identifiers.
- Application logs showing successful getReportById responses without an associated getProjectAccess evaluation.
Detection Strategies
- Instrument the report.get handler to log ctx.session.userId, the returned report.projectId, and the membership decision for correlation.
- Add a server-side audit rule that flags any read where the report's projectId is outside the caller's project membership set.
- Review reverse-proxy or API gateway logs for high-cardinality reportId values from a single client within short time windows.
Monitoring Recommendations
- Forward tRPC access logs to a centralized log store and alert on cross-tenant identifier access patterns.
- Baseline normal report.get request rates per user and alert on deviations that suggest enumeration.
- Retain request/response metadata long enough to reconstruct which reports were exposed if abuse is later discovered.
How to Mitigate CVE-2026-77768
Immediate Actions Required
- Upgrade Openpanel to the version containing commit 0a51b68, which adds getProjectAccess checks to the affected procedure.
- Rotate any secrets, filters, or formulas embedded in reports that may have been exposed to unauthorized tenants.
- Audit historical logs for unexpected report.get invocations tied to identifiers outside a caller's project scope.
Patch Information
The fix is delivered in Openpanel commit 0a51b6805eed0b3da8376175acd5fa3d26819cb6, referenced by GitHub Security Advisory GHSA-9x7c-f87x-2243 and the VulnCheck advisory. The patch resolves the report first, then calls getProjectAccess against the resolved projectId before returning data.
Workarounds
- If immediate patching is not possible, restrict instance access to trusted users only and disable new account registration.
- Apply a reverse-proxy rule to block or rate-limit unauthenticated enumeration of the report.get endpoint.
- Backport the middleware change locally so report.get resolves the report and invokes getProjectAccess before returning.
# Update Openpanel to include commit 0a51b68 or later
git fetch origin
git checkout main
git pull origin main
pnpm install
pnpm build
# Restart the Openpanel services after deployment
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
