# CVE-2026-45297: OpenReplay cross-tenant IDOR in feature-flag and assist-stats routes

Source: https://junglewise.ai/threats/cve-2026-45297-openreplay-cross-tenant-idor-in-feature-flag-and-assist-stats  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-45297 · Severity: info · CVSS 5.3 · Published 2026-05-28

OpenReplay is a session replay suite used by businesses to analyze user interactions on their websites. In multi-tenant Enterprise environments, a security flaw allows an authenticated user from one organization to view, modify, or delete the feature flags and session analytics of another organization. This could lead to the exposure of sensitive user segment data or the disruption of application features for other customers.

Vendors: [OpenReplay](https://junglewise.ai/threats/vendors/openreplay).

## Quick answers

**Is CVE-2026-45297 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45297 being exploited in the wild.

**How severe is CVE-2026-45297?** Informational severity, with a CVSS score of 5.3, published 28 May 2026.

**Which products and versions are affected?** OpenReplay Enterprise Edition < 1.26.0; OpenReplay OSS < 1.26.0.

**Is there a fix for CVE-2026-45297?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45297 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45297?** Check whether you run OpenReplay Enterprise Edition or OpenReplay OSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) exists in the feature-flag and assist-stats routes due to a case-mismatch in the ProjectAuthorizer component. The authorizer fails to perform authorization checks when the project identifier is provided as 'project_id' instead of the expected camelCase 'projectId'. In multi-tenant Enterprise Edition (EE) environments, database queries for feature flags filter only by project_id and not by tenant_id. An authenticated attacker can exploit this by iterating through sequential integer IDs to read, update, or delete feature flag rows and session analytics across different tenants. While the vulnerable code exists in the OpenReplay OSS version, it is single-tenant by design, limiting the practical impact to the Enterprise Edition. The issue is resolved in version 1.26.0.

## Affected products

- OpenReplay OpenReplay Enterprise Edition < 1.26.0
- OpenReplay OpenReplay OSS < 1.26.0

## Timeline

- 2026-05-08: advisory: GitHub Security Advisory published
- 2026-05-28: disclosed: CVE published to NVD

## References

- [https://github.com/openreplay/openreplay/security/advisories/GHSA-5m23-rcj4-cgjx](https://github.com/openreplay/openreplay/security/advisories/GHSA-5m23-rcj4-cgjx)

## Related threats

- [OpenReplay Enterprise SQL injection in session search API](https://junglewise.ai/threats/cve-2026-57230-openreplay-enterprise-sql-injection-in-session-search-api)