Live › vulnerability › CVE-2026-116806
Go to dashboardOpenPanel before 3.0.0 lets any organization member call the onboarding.project tRPC mutation, which is meant to be admin-only. The call creates projects and returns plaintext write-type ingestion secrets, so a member can inject fake analytics events and use the organization's usage budget.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Self-hosted or hosted OpenPanel instances below 3.0.0 with multiple organization members who are not admins. Single-user deployments where every member is an admin are less exposed, since the bypass only matters for non-admin roles.
No product ranges from the sources yet.
package.json or the image tag; versions below 3.0.0 are affected3.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a member session to obtain plaintext secrets, inject fake analytics events, poison business metrics, and consume the organization's usage budget.
This page as .md · .json · in your agent: get_signal("CVE-2026-116806")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.