Executive brief
OpenReplay, a self-hosted session replay suite used to monitor user interactions on websites, is affected by a security flaw in its dashboard and note management features. An authenticated user can delete or modify private session notes and dashboard widgets belonging to other users. This could lead to the loss of important session data and the disruption of private monitoring dashboards within an organization.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in OpenReplay versions 1.27.0 and earlier due to missing ownership predicates in specific SQL mutation functions. While read and edit functions correctly validate ownership, the 'notes.delete', 'dashboards.update_widget', and 'dashboards.remove_widget' functions only filter by object IDs (note, project, dashboard, or widget IDs) without verifying the 'user_id' of the requester. Because object identifiers are sequential integers, an authenticated attacker can enumerate and modify or delete private session notes and dashboard widgets belonging to other users. The vulnerability affects installations with multi-tenancy enabled and results in integrity and availability loss, though the read path remains protected.
Affected products
- OpenReplay OpenReplay <= 1.27.0
Timeline
- 2026-06-16: advisory: Initial GitHub security advisory published
- 2026-07-10: disclosed: CVE published to NVD