Description

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim organization's guessable dashboardId to read confidential report definitions or permanently delete dashboard layouts across tenant boundaries.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-04T12:17:24.593Z",
  "pubdate": "2026-09-04T12:17:24.593Z",
  "executiveSummary": "OpenPanel versions prior to 2.3.0 are susceptible to a critical Cross-Tenant Broken Object Level Authorization (BOLA) vulnerability. This security flaw exists within the tRPC infrastructure, specifically impacting the report.getLayouts and report.resetLayout procedures.\nThe vulnerability arises from a failure to perform adequate authorization checks to ensure that requested resources are scoped to the caller's specific project identifier. Consequently, an authenticated attacker can bypass logical boundaries, enabling unauthorized access to or destruction of data belonging to other tenants.\nThe impact includes unauthorized disclosure of confidential dashboard configurations and the permanent deletion of critical report layouts across the entire platform. Because the attack requires only an authenticated session and knowledge of a predictable dashboard identifier, the risk is severe for multi-tenant environments. No advanced administrative privileges are required to exploit this flaw, as the system fails to validate the ownership of the provided projectId during the tRPC execution flow.\nThis vulnerability highlights a systemic failure in the backend authorization logic, necessitating immediate remediation to maintain data integrity and tenant isolation.",
  "technicalDetails": "The vulnerability resides in the backend implementation of the tRPC API endpoints, specifically within the report.getLayouts and report.resetLayout functions. The root cause is an improper authorization check that fails to enforce tenant-level isolation between a user's authenticated project context and the requested resource data.\nWhen a request is initiated via tRPC, the server-side logic processes the input parameters, which include a projectId and a dashboardId. The application logic fails to verify if the authenticated user has legitimate access to the project associated with the provided dashboardId. Instead of validating the session token's scope against the requested object's metadata, the backend performs operations based solely on the user-supplied identifiers.\nThe attack flow proceeds as follows: First, an authenticated attacker initiates a tRPC call to either report.getLayouts or report.resetLayout. Second, the attacker supplies their own valid projectId along with a guessable dashboardId that belongs to a different tenant. Because the system lacks a cross-tenant validation mechanism, it processes the request as if the attacker possesses legitimate ownership of the target resource.\nFor the report.getLayouts procedure, the server returns confidential report definition data belonging to the victim organization, leading to sensitive information disclosure. For the report.resetLayout procedure, the server executes a deletion or reset operation on the victim's dashboard layout, resulting in a permanent denial of service for that specific resource's configuration.\nThe lack of server-side object-level verification permits an attacker to perform unauthorized cross-tenant operations simply by iterating through predictable dashboard identifiers. This vulnerability is accessible via any authenticated session and does not require elevated administrative privileges, as the system treats the input parameters as authoritative without cross-referencing them with the user's assigned permissions. The scope of impact is limited only by the attacker's ability to identify valid dashboardId values through reconnaissance or incremental discovery techniques."
}