OpenPanel versions up to 2.3.0 have a CSV formula injection vulnerability. This flaw allows unauthenticated attackers to inject spreadsheet formulas via crafted profile IDs sent to the /track endpoint. When cohort data is exported to CSV, these formulas can execute, potentially exfiltrating adjacent cell data. The vulnerability has a low CVSS score of 2.3 and does not require privileges to exploit.
OpenPanel js-runtime versions up to 2.3.0 have a critical code injection vulnerability due to improper sandboxing in the JavaScript webhook template validator. This flaw allows attackers with project write access to execute arbitrary code by exploiting computed property access to constructor chains. The vulnerability enables escape from the sandbox environment, potentially compromising the worker process.
CVE-2026-93984 is an authentication vulnerability in Openpanel-dev's openpanel tracking API up to version 2.3.0. The API fails to verify the client secret cryptographic hash before authorizing revenue events and bot filtering. This allows attackers possessing only a public client ID to supply arbitrary dummy secrets, enabling them to inject forged revenue metrics and bypass bot detection filters.
CVE-2026-93983 is a medium severity SQL injection vulnerability in Openpanel-dev's openpanel product. Versions 0 through 2.3.0 fail to properly escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. This flaw enables attackers to bypass project isolation and access metrics from other projects by supplying crafted filter names.
OpenPanel versions up to 2.3.0 log Model Context Protocol authentication tokens from URL query parameters in plaintext without redaction. This allows attackers with access to application logs or stdout to capture base64-encoded credentials and potentially replay MCP requests to access project analytics.
OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.
In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/safe-fetch.ts). In packages/importer/src/providers/umami.ts, parseRemoteFile calls fetch() on config.fileUrl, which is validated only by z.string().url(), so values such as http://127.0.0.1:9911/ or http://169.254.169.254/latest/meta-data/ are accepted; the shared createFileImportConfig factory gives the plausible provider the same field. An authenticated organization member — including a default 'member' with no project_access rows, for whom the intended access-level check is skipped because getProjectAccess returns boolean true rather than a level object — can therefore make the server connect to any address reachable from it. The resulting HTTP status and status text are persisted as Import.errorMessage and returned by import.get to the same user, providing a scanning oracle for internal hosts, ports and paths; if an internal response parses as Umami CSV, its rows are ingested as events and become readable in the attacker's analytics views.
OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers.
OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII via blind boolean oracle techniques.
Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId to read report layouts and configurations or delete dashboard grid arrangements across tenants.
OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue requests to internal services, localhost, and cloud metadata endpoints, reading internal HTTP response titles, headers, status codes, and SSL certificate information.
OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the victim's browser on the API origin, enabling same-origin credentialed requests to authenticated endpoints.
OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata endpoints, with small responses returned verbatim enabling credential theft and internal service enumeration.
OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim organization's guessable dashboardId to read confidential report definitions or permanently delete dashboard layouts across tenant boundaries.
OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to load Node.js built-ins and execute operating system commands with the privileges of the API process, bypassing organization authorization boundaries.
Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The endpoint passes a user-supplied url query parameter to fetchWithRedirects() and performs server-side HTTP requests to arbitrary URLs without any SSRF/IP validation. An unauthenticated remote attacker can access cloud instance metadata endpoints, probe internal services, scan internal network ports, and read returned content (status code, page size, timing, and parsed HTML metadata), and leak internal IP addresses (via getIPInfo() to a third party).
CVE-2026-77769 is an authorization bypass vulnerability in Openpanel-dev's openpanel product. The issue arises because the report.list procedure verifies project membership but does not confirm that the dashboardId belongs to the same project. This allows an authenticated user to access reports from dashboards outside their organization by pairing their projectId with another organization's dashboardId. The vulnerability results from improper scoping in the report retrieval function, which selects reports by dashboardId alone without project validation.
CVE-2026-77768 is an authorization bypass vulnerability in the Openpanel-dev openpanel product. The vulnerability exists in the report.get procedure, which accepts only a reportId and returns the report data without proper project or organization membership checks. This allows any authenticated user to access the full configuration of any saved report by supplying its identifier. Other related procedures such as update, delete, and duplicate correctly enforce project access checks, so the issue is isolated to the report.get procedure.