CVE-2026-88891

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to 2.3.1

Description Missing access level validation in mutation resolvers allows members with read-only project access to perform unauthorized actions. This issue affects 26 of 29 mutating procedures, enabling users to modify, delete, and publish project data. Specifically, attackers can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules.

Recommendations Update to version 2.3.1 or later.