Threat Intelligence Database

CVE-2026-77769 is an authorization bypass vulnerability in Openpanel-dev's openpanel product. The report.list procedure improperly validates dashboard access by only verifying project membership but not whether the dashboard belongs to the project. This allows an authenticated user to access reports from dashboards outside their authorized project by supplying a mismatched dashboardId. The vulnerability arises because the router uses a function that selects reports by dashboardId alone without project scoping, despite a properly scoped helper function existing but not being used.

CVE-2026-77768 is an authorization bypass vulnerability in the openpanel product by Openpanel-dev. The vulnerability exists in the report.get procedure, which accepts only a reportId and returns the report data without proper project or organization membership checks. This allows any authenticated user to access the full configuration of any saved report by supplying its identifier. Other related procedures such as update, delete, and duplicate correctly enforce project access checks, so the issue is specific to the get procedure.