Openpanel versions before 2.3.0 contain an insecure direct object reference flaw in the report.getLayouts and report.resetLayout tRPC procedures. The procedures do not bind the dashboardId to the authenticated user’s projectId, allowing an attacker who is logged in to supply another project’s dashboardId. This enables read access to report layouts, configuration data, and delete operations for dashboard grid arrangements belonging to other tenants.

All Openpanel installations from the initial release up to, but not including, version 2.3.0. The vulnerability is present in every deployment of Openpanel where the affected tRPC procedures are exposed to authenticated users.

The vulnerability has a CVSS score of 5.3, indicating a medium impact when combined with user authentication. EPSS data is not available and the issue is not listed in the CISA KEV catalog. Attackers must be authenticated and capable of calling the API endpoints; the exploit path is straightforward once credentials are obtained, so the overall risk depends largely on user privilege management.