Veille CVE

Vendredi 4 septembre 2026

2 CVE sur 7

Critique 0 Élevée 5 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Openpanel-dev openpanel » ✕
  1. CVE-2026-85615 6.4 Moyenne

    Openpanel-dev openpanel

    Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId to read report layouts and configurations or delete dashboard grid arrangements across tenants.

  2. CVE-2026-85611 6.4 Moyenne

    Openpanel-dev openpanel

    OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim organization's guessable dashboardId to read confidential report definitions or permanently delete dashboard layouts across tenant boundaries.