Threats tagged 'ghsa-7qfj-9p8q-5fq8'

OpenPanel versions before 3.0.0 have a missing authorization vulnerability in the onboarding.project tRPC mutation. This flaw allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing intended admin-only restrictions. Exploitation enables attackers to obtain plaintext secrets, inject fake analytics events, poison business metrics, and consume the organization's usage budget.