CVE-2026-77769

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The report.list procedure in packages/trpc/src/routers/report.ts allows an authenticated user to access reports from other organizations. While the enforceAccess middleware in packages/trpc/src/trpc.ts verifies membership for the provided projectId, it does not verify if the dashboardId belongs to that project. Consequently, the getReportsByDashboardId() function in packages/db/src/services/reports.service.ts retrieves reports based solely on the dashboardId without project scoping. An attacker can provide a projectId from their own organization to bypass the middleware and a dashboardId from another organization to retrieve all reports associated with that dashboard.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.