CVE-2026-116806

MediumCVSS 5.4/10Last modified Nov 4, 2026

Description

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a member session to obtain plaintext secrets, inject fake analytics events, poison business metrics, and consume the organization's usage budget.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-269

Affected software

VendorProductVersions
Openpanel-devopenpanel< 3.0.0

References

Timeline

Published
Oct 27, 2026
Last modified
Nov 4, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1168076.5OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescapCVE-2026-1168087.2OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafCVE-2026-1168095.3OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackersCVE-2026-116818.8Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption vCVE-2026-1168105.3OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotationCVE-2026-1168118.8OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST alCVE-2026-1168126.5OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members tCVE-2026-1168136.5OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and shareCVE-2026-1168146.5OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standaCVE-2026-1168154.3OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break CCVE-2026-1168167.8llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrCVE-2026-1168176.5OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashbo
CVE-2026-116806: Medium severity, CVSS 5.4 | Vulnix