In OpenReplay versions 1.27.0 and earlier, the notes.delete, dashboards.update_widget, and dashboards.remove_widget functions omitted the ownership predicate that their corresponding read and edit counterparts enforce. This missing check allows an authenticated member to delete another user’s private session notes or manipulate widgets on a private dashboard, resulting in loss or alteration of confidential session data.

The affected product is OpenReplay, a self‑hosted session replay suite; all releases versioned up to and including 1.27.0 are impacted.

The CVSS score of 7.1 classifies this as a high‑severity vulnerability, and the EPSS score of < 1% indicates a very low exploitation probability. The alert is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must first authenticate as a member of the OpenReplay instance and then invoke the affected endpoints; no remote code execution or privileges beyond an ordinary authenticated user are required. The impact is limited to unauthorized deletion or modification of another user’s private notes or dashboard widgets, but the loss of sensitive session data can be significant for the affected users.