The report.list procedure in OpenPanel accepts a project id and a dashboard id, then queries all reports that belong to that dashboard without verifying the dashboard belongs to the supplied project. This missing validation allows an authenticated user to supply a dashboard id that belongs to another organization while providing a project id that the user is a member of, causing the service to return every report from the other organization’s dashboard. As a result, confidential reports can be accessed by individuals who do not belong to the target organization, constituting a data disclosure across organization boundaries.

This vulnerability affects the OpenPanel project (Openpanel‑dev:openpanel) in all versions that have not applied the fix. The code paths involved are located in packages/trpc/src/routers/report.ts and packages/db/src/services/reports.service.ts. No specific version range is listed, so any deployment that has not been updated to a corrected version is potentially exposed.

The CVSS score of 7.1 indicates a moderate severity with potential for significant data loss. The EPSS score is not available, so the probability of public exploitation is unknown; however, the absence of a CPES or network reachability notes suggests the vulnerability requires a user who can authenticate to the system. The attacker must possess valid credentials and must know both project and dashboard identifiers, which may be discoverable via existing API or UI. The weakness is classified as CWE-639 (Authorization Bypass Through User-Controlled Search Condition). As the vulnerability enables unauthorized access to sensitive data, organizations should treat it as a priority for remediation.