Executive brief
OpenReplay is a session replay suite used by businesses to analyze user interactions on their websites. In multi-tenant Enterprise environments, a security flaw allows an authenticated user from one organization to view, modify, or delete the feature flags and session analytics of another organization. This could lead to the exposure of sensitive user segment data or the disruption of application features for other customers.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the feature-flag and assist-stats routes due to a case-mismatch in the ProjectAuthorizer component. The authorizer fails to perform authorization checks when the project identifier is provided as 'project_id' instead of the expected camelCase 'projectId'. In multi-tenant Enterprise Edition (EE) environments, database queries for feature flags filter only by project_id and not by tenant_id. An authenticated attacker can exploit this by iterating through sequential integer IDs to read, update, or delete feature flag rows and session analytics across different tenants. While the vulnerable code exists in the OpenReplay OSS version, it is single-tenant by design, limiting the practical impact to the Enterprise Edition. The issue is resolved in version 1.26.0.
Affected products
- OpenReplay OpenReplay Enterprise Edition < 1.26.0
- OpenReplay OpenReplay OSS < 1.26.0
Timeline
- 2026-05-08: advisory: GitHub Security Advisory published
- 2026-05-28: disclosed: CVE published to NVD