Threats tagged 'ghsa-74w8-8m6p-549q'

OpenPanel versions prior to 3.0.0 have a missing authorization vulnerability that permits unauthenticated attackers to read annotations from any project. This occurs via the public reference.getChartReferences tRPC procedure, which can be invoked with guessable slug-based project IDs to access cross-tenant annotation data such as titles, descriptions, and dates.