The report.get procedure in OpenPanel accepts only a report identifier and immediately returns the report details by calling getReportById without verifying the requesting user's membership in the report’s owning project. The enforceAccess middleware performs its checks only when the request payload contains a project or organization identifier, so a request comprised solely of a reportId bypasses access control. As a result, any authenticated user can read the full configuration of any saved report—including the owning project, event series, filters, breakdowns, and formulas—by simply supplying the report’s identifier.

The flaw resides in the OpenPanel application developed by Openpanel-dev. No specific product version range is provided, but any instance of OpenPanel that incorporates the affected code paths in packages/trpc/src/routers/report.ts and packages/db/src/services/reports.service.ts is potentially vulnerable.

The CVSS score of 7.1 indicates a high‑impact vulnerability. Exacerbated by the lack of project scoping, the flaw allows an authenticated attacker to exfiltrate sensitive configuration data. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. The likely attack vector is through legitimate API calls by any user with valid credentials, which can be executed remotely.