CVE-2026-85615: Openpanel Auth Bypass Vulnerability

CVE-2026-85615 Overview

CVE-2026-85615 is an Insecure Direct Object Reference (IDOR) vulnerability in Openpanel versions before 2.3.0. The flaw resides in the report.getLayouts and report.resetLayout tRPC procedures, which fail to bind the supplied dashboardId to the caller's authorized projectId. Authenticated users can therefore submit any victim dashboardId together with their own projectId to read report layouts and configurations or delete dashboard grid arrangements belonging to other tenants. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated tenant can enumerate or destroy dashboard layouts across every other tenant in the same Openpanel deployment, breaking multi-tenant isolation.

Affected Products

Openpanel versions prior to 2.3.0
Deployments exposing the report.getLayouts tRPC procedure
Deployments exposing the report.resetLayout tRPC procedure

Discovery Timeline

2026-09-04 - CVE-2026-85615 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85615

Vulnerability Analysis

Openpanel is a multi-tenant analytics platform where each user belongs to one or more projects. Dashboards and their layout metadata are scoped to a projectId. The report.getLayouts and report.resetLayout tRPC procedures accept both a dashboardId and a projectId from the client. The server verifies that the caller has access to the supplied projectId but never verifies that the supplied dashboardId actually belongs to that project. An attacker with any valid project membership can pass an arbitrary victim dashboardId alongside their own projectId and the query executes against the victim's dashboard.

Calling report.getLayouts in this manner returns the victim tenant's dashboard grid layout and widget configuration. Calling report.resetLayout deletes or resets the victim's layout, corrupting the target dashboard for legitimate users. Both procedures require authentication but no elevated privileges.

Root Cause

The authorization check is performed on the wrong identifier. The tRPC procedures validate ownership of projectId but treat dashboardId as a trusted, unbound reference. There is no join query or ownership assertion confirming that dashboard.projectId equals the authenticated caller's projectId. This is a textbook [CWE-639] cross-tenant IDOR.

Attack Vector

Exploitation is remote and requires a low-privileged authenticated account on the target Openpanel instance. The attacker enumerates or guesses valid dashboardId values belonging to other tenants and submits a crafted tRPC request combining that identifier with a projectId the attacker legitimately owns. The server returns the victim's layout data on report.getLayouts, or destroys the victim's saved layout on report.resetLayout. No user interaction from the victim is required. See the GitHub Security Advisory GHSA-5cpv-vqvr-7mrh and the VulnCheck Advisory for Openpanel IDOR for procedure-level detail.

// No verified proof-of-concept code is published for CVE-2026-85615.
// Refer to the linked advisories for procedure-level detail.

Detection Methods for CVE-2026-85615

Indicators of Compromise

tRPC requests to report.getLayouts or report.resetLayout where the supplied dashboardId does not resolve to a dashboard owned by the caller's projectId.
Unexpected DELETE or UPDATE operations against dashboard layout tables originating from user accounts that do not own the affected dashboards.
Reports from tenants of dashboard layouts being wiped or reset without an explicit user action.

Detection Strategies

Add server-side logging that records projectId, dashboardId, and userId for every call to report.getLayouts and report.resetLayout, then alert on mismatches between dashboard.projectId and the caller's project membership.
Replay historical tRPC access logs and cross-reference them against dashboard ownership metadata to identify past cross-tenant queries.
Monitor database audit trails for layout SELECT and DELETE statements whose WHERE clause omits a projectId predicate.

Monitoring Recommendations

Ingest Openpanel application and database logs into a centralized analytics platform and build tenant-scoped baselines for dashboard read and reset rates.
Alert on any single account issuing report.getLayouts requests against more distinct dashboardId values than the account owns.
Track advisory updates from the Openpanel project so new patches or related IDOR issues are triaged quickly.

How to Mitigate CVE-2026-85615

Immediate Actions Required

Upgrade Openpanel to version 2.3.0 or later on every deployment.
Rotate long-lived API tokens and session credentials issued to tenants that may have been targeted.
Review dashboard layout tables for unauthorized modifications and restore from backup where corruption is confirmed.

Patch Information

The issue is fixed in Openpanel 2.3.0. The upstream fix binds dashboardId to the authorized projectId inside the report.getLayouts and report.resetLayout procedures so that requests referencing a dashboard outside the caller's project are rejected. Refer to the GitHub Security Advisory GHSA-5cpv-vqvr-7mrh for release notes and commit references.

Workarounds

If immediate upgrade is not possible, place a reverse-proxy or middleware check in front of the tRPC endpoint that validates dashboardId ownership against the caller's session before the request reaches Openpanel.
Restrict access to the Openpanel instance to trusted networks and reduce the number of authenticated tenants until the patched version is deployed.
Temporarily disable the report.resetLayout procedure at the router level to prevent destructive cross-tenant writes while remediation is planned.

bash

# Upgrade Openpanel to the patched release
npm install openpanel@^2.3.0
# or, for container deployments
docker pull openpanel/openpanel:2.3.0
docker compose up -d