CVE-2026-55880

Name of the Vulnerable Software and Affected Versions OpenReplay versions prior to 1.27.1

Description An issue exists in the session replay suite where three mutation functions execute SQL queries without the necessary ownership predicate. This allows any authenticated member to delete private session notes of other users or remove and rewrite widgets on private dashboards belonging to other users. The affected functions are notes.delete(), dashboards.update widget(), and dashboards.remove widget(). In these cases, notes.delete() filters only by note and project IDs, while the dashboard functions filter only by dashboard and widget IDs, bypassing ownership verification.

Recommendations Update to a version later than 1.27.0. As a temporary mitigation, restrict access to the notes.delete(), dashboards.update widget(), and dashboards.remove widget() functions.