CVE-2026-77769: Authorization Bypass Through User-Controlled Key in Openpanel-dev openpanel

The vulnerability in openpanel occurs in the report.list procedure where the enforceAccess middleware verifies membership for a supplied projectId but does not verify that the dashboardId belongs to that project. The function getReportsByDashboardId returns reports based solely on dashboardId without project scoping. Consequently, an authenticated user can supply their own projectId (passing the middleware check) with a dashboardId from another organization and retrieve all reports from that dashboard. Although a correctly scoped helper function, listReportsCore, exists and resolves the dashboard through getDashboardById(dashboardId, projectId), the router does not use it, leading to this authorization bypass.

An authenticated user with valid project membership can access reports from dashboards belonging to other organizations by exploiting the lack of proper dashboard-to-project association checks. This results in unauthorized disclosure of potentially sensitive report data. The vulnerability impacts confidentiality but does not affect integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid exposing the vulnerable report.list procedure or implement additional access controls to ensure dashboardId belongs to the authenticated user's project. Using the correctly scoped helper function listReportsCore that validates dashboard ownership is recommended once a patch or update is provided.