CVE-2026-85615

Name of the Vulnerable Software and Affected Versions Openpanel versions prior to 2.3.0

Description An insecure direct object reference occurs in the report.getLayouts and report.resetLayout tRPC procedures. These procedures fail to bind the dashboardId to the authorized projectId, allowing authenticated attackers to provide an arbitrary victim dashboardId alongside their own projectId. This can lead to the unauthorized reading of report layouts and configurations or the deletion of dashboard grid arrangements across different tenants.

Recommendations Update to version 2.3.0 or later.