Description
OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers.
Published: 2026-09-10
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Access control bypass allowing read‑only members to modify or delete project data
Action: Patch Immediately
AI Analysis

Impact

OpenPanel up through version 2.3.0 does not enforce read‑only project access on 26 of 29 mutating procedures. This flaw allows members with only read privileges to modify, delete, or publish project data. An attacker can delete reports and dashboards, schedule complete projects for deletion, publish private analytics as public share links, and alter alerting rules. The vulnerability compromises data integrity, confidentiality, and availability.

Affected Systems

The affected product is OpenPanel from Openpanel‑dev. All installations running version 2.3.0 or earlier are vulnerable until vendor remediation is applied.

Risk and Exploitability

The CVSS score of 7.2 classifies this as a high‑severity vulnerability. An attacker only needs legitimate read‑only access and can exploit exposed mutation resolvers to perform destructive or exposing actions. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, but the potential for data loss and accidental disclosure warrants immediate action.

Generated by OpenCVE AI on October 2, 2026 at 15:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the Openpanel‑dev website or GitHub advisory for a vendor‑supplied update that re‑enforces access‑level validation in mutation resolvers
  • If a patch is not yet released, restrict mutation endpoints to privileged users by configuring firewall or reverse‑proxy rules to block read‑only access
  • Monitor mutation activity logs for unexpected write operations and investigate any deviations from expected behavior

Generated by OpenCVE AI on October 2, 2026 at 15:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:openpanel:openpanel:*:*:*:*:*:*:*:*

Fri, 02 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers. OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers.
Title OpenPanel Read-Only Access Level Enforcement Bypass via Mutations OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations
CPEs cpe:2.3:a:openpanel:openpanel:*:*:*:*:*:*:*:*
References

Tue, 15 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers.
Title OpenPanel Read-Only Access Level Enforcement Bypass via Mutations
First Time appeared Openpanel
Openpanel openpanel
Weaknesses CWE-269
CPEs cpe:2.3:a:openpanel:openpanel:*:*:*:*:*:*:*:*
Vendors & Products Openpanel
Openpanel openpanel
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H'}

cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Openpanel Openpanel
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-27T10:14:43.762Z

Reserved: 2026-09-10T11:28:50.296Z

Link: CVE-2026-88891

cve-icon Vulnrichment

Updated: 2026-09-15T14:25:36.235Z

cve-icon NVD

Status : Deferred

Published: 2026-09-10T14:17:18.340

Modified: 2026-10-02T15:17:12.153

Link: CVE-2026-88891

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T15:45:18Z

Weaknesses
  • CWE-269

    Improper Privilege Management