Live › vulnerability › CVE-2026-116809
Go to dashboardOpenPanel before 3.0.0 has a missing authorization check in its event.bots tRPC procedure. An unauthenticated attacker who supplies a projectId can read bot event names, types and paths for private or password-protected projects, which reveals internal routes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Self-hosted or hosted OpenPanel instances older than 3.0.0 that host private or password-protected projects are exposed, since the flaw only checks that a shareOverview row exists. Instances on 3.0.0 or later, or instances with no private projects, are not affected by this description.
No product ranges from the sources yet.
unknown, or look at the deployed image tag or package.json version.3.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types, and paths for private or password-protected projects, revealing internal routes.
This page as .md · .json · in your agent: get_signal("CVE-2026-116809")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.