CVE-2026-77768

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An authenticated user can read the full configuration of any saved report on the instance, including the owning projectId, event series, filters, breakdowns, and formulas, by providing a report identifier. This occurs because the report.get procedure in packages/trpc/src/routers/report.ts accepts only a reportId and returns getReportById(reportId) directly. The enforceAccess middleware in packages/trpc/src/trpc.ts only evaluates membership when the input contains a projectId or organizationId key, allowing inputs with only a reportId to pass unchecked. Additionally, the getReportById function in packages/db/src/services/reports.service.ts performs a findUnique operation on the report ID without project scoping.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.