CVE-2026-85611: OpenPanel Auth Bypass Vulnerability

CVE-2026-85611 is an authentication bypass flaw in OpenPanel that enables cross-tenant access to confidential dashboard data. Attackers can read report definitions or delete layouts across tenant boundaries. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-85611 Overview

CVE-2026-85611 is a cross-tenant Broken Object Level Authorization (BOLA) vulnerability in OpenPanel versions before 2.3.0. The flaw resides in the report.getLayouts and report.resetLayout tRPC procedures, which fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId alongside a victim organization's guessable dashboardId. This allows them to read confidential report definitions or permanently delete dashboard layouts belonging to other tenants. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated tenants can read confidential report layouts and permanently delete dashboards across organizational boundaries in shared OpenPanel deployments.

Affected Products

OpenPanel versions prior to 2.3.0
Deployments exposing the report.getLayouts tRPC procedure
Deployments exposing the report.resetLayout tRPC procedure

Discovery Timeline

2026-09-04 - CVE-2026-85611 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85611

Vulnerability Analysis

OpenPanel is a multi-tenant analytics platform where dashboards are scoped to organizations and projects. The report.getLayouts and report.resetLayout tRPC procedures accept a projectId and a dashboardId from the client. Both procedures use the supplied dashboardId to look up dashboard layouts without verifying that the target dashboard actually belongs to the caller's project or organization.

Because the authorization check trusts the client-provided projectId rather than binding the lookup to the authenticated session's tenant, any authenticated user can enumerate arbitrary dashboards. The read path exposes confidential report definitions, including custom metrics, filters, and query logic that competitors or attackers can harvest. The write path allows destructive resetLayout calls that permanently remove another tenant's dashboard configuration.

Root Cause

The root cause is missing server-side tenancy enforcement in the tRPC layer. The procedures rely on user-controlled identifiers as the sole scoping mechanism instead of joining the query against the authenticated user's organization membership. This is a textbook BOLA pattern where object references are checked for shape but not for ownership.

Attack Vector

An attacker requires an authenticated account on the OpenPanel instance, which may be a low-privileged tenant account. The attacker calls report.getLayouts or report.resetLayout with their own projectId and a guessed or enumerated dashboardId belonging to a victim tenant. Dashboard identifiers in OpenPanel are guessable, which lowers the effort required to locate valid targets. No user interaction from the victim is required, and the attack executes over the network against the tRPC endpoint.

See the GitHub Security Advisory GHSA-g3xf-pqfp-22v7 and the VulnCheck advisory on OpenPanel for additional technical context.

Detection Methods for CVE-2026-85611

Indicators of Compromise

tRPC requests to report.getLayouts or report.resetLayout where the dashboardId does not resolve to a dashboard owned by the authenticated user's project.
Repeated calls from a single account with iterating or brute-forced dashboardId values.
Unexpected resetLayout operations that remove dashboard configurations without a corresponding administrative action.

Detection Strategies

Enable verbose logging on the tRPC router and correlate dashboardId values with the authenticated user's organization to flag cross-tenant references.
Alert on report.resetLayout invocations that touch dashboards outside the caller's project scope.
Baseline normal dashboard access patterns per tenant and flag anomalous fan-out across many dashboardId values from one session.

Monitoring Recommendations

Ship OpenPanel application logs and reverse-proxy access logs to a centralized analytics pipeline for retention and correlation.
Monitor authentication and audit logs for accounts issuing high volumes of report.* procedure calls in short windows.
Track dashboard deletion and reset events against a change-management source of truth to detect unauthorized modifications.

How to Mitigate CVE-2026-85611

Immediate Actions Required

Upgrade OpenPanel to version 2.3.0 or later, which introduces server-side tenancy checks on the affected procedures.
Audit application logs for prior invocations of report.getLayouts and report.resetLayout referencing cross-tenant dashboardId values.
Restore any dashboards that were reset without authorization from backups or version-controlled configuration.

Patch Information

The vendor addressed CVE-2026-85611 in OpenPanel 2.3.0. The fix scopes dashboard lookups in the report.getLayouts and report.resetLayout tRPC procedures to the authenticated caller's project and organization. Refer to the GitHub Security Advisory GHSA-g3xf-pqfp-22v7 for release notes.

Workarounds

Restrict network access to the OpenPanel tRPC endpoints so that only trusted, single-tenant users can reach them until the patch is applied.
Rotate or invalidate long-lived session tokens for accounts suspected of enumerating dashboards across tenants.
Deploy a reverse-proxy rule that rejects report.getLayouts and report.resetLayout requests originating from low-trust accounts until upgrade is complete.

bash

# Upgrade OpenPanel to the patched release
npm install openpanel@2.3.0
# or, for Docker deployments
docker pull openpanel/openpanel:2.3.0
docker compose up -d