# CVE-2026-55880: OpenReplay IDOR in session notes and dashboard widgets

Source: https://junglewise.ai/threats/cve-2026-55880-openreplay-idor-in-session-notes-and-dashboard-widgets  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55880 · Severity: high · CVSS 7.1 · Published 2026-07-10

OpenReplay, a self-hosted session replay suite used to monitor user interactions on websites, is affected by a security flaw in its dashboard and note management features. An authenticated user can delete or modify private session notes and dashboard widgets belonging to other users. This could lead to the loss of important session data and the disruption of private monitoring dashboards within an organization.

Technologies: [OpenReplay](https://junglewise.ai/threats/technologies/openreplay). Vendors: [OpenReplay](https://junglewise.ai/threats/vendors/openreplay).

## Quick answers

**Is CVE-2026-55880 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55880 being exploited in the wild.

**How severe is CVE-2026-55880?** High severity, with a CVSS score of 7.1, published 10 July 2026.

**Which products and versions are affected?** OpenReplay <= 1.27.0.

**Is there a fix for CVE-2026-55880?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-55880 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55880?** Check whether you run OpenReplay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in OpenReplay versions 1.27.0 and earlier due to missing ownership predicates in specific SQL mutation functions. While read and edit functions correctly validate ownership, the 'notes.delete', 'dashboards.update_widget', and 'dashboards.remove_widget' functions only filter by object IDs (note, project, dashboard, or widget IDs) without verifying the 'user_id' of the requester. Because object identifiers are sequential integers, an authenticated attacker can enumerate and modify or delete private session notes and dashboard widgets belonging to other users. The vulnerability affects installations with multi-tenancy enabled and results in integrity and availability loss, though the read path remains protected.

## Affected products

- OpenReplay OpenReplay <= 1.27.0

## Timeline

- 2026-06-16: advisory: Initial GitHub security advisory published
- 2026-07-10: disclosed: CVE published to NVD

## References

- [https://github.com/openreplay/openreplay/security/advisories/GHSA-9xfv-p2fx-vmx9](https://github.com/openreplay/openreplay/security/advisories/GHSA-9xfv-p2fx-vmx9)

## Related threats

- [OpenReplay IDOR in getFirstMob endpoint allows cross-tenant data access](https://junglewise.ai/threats/cve-2026-55881-openreplay-idor-in-getfirstmob-endpoint-allows-cross-tenant-data)
- [OpenReplay stored XSS in tracking SDK leads to account takeover](https://junglewise.ai/threats/cve-2026-55879-openreplay-stored-xss-in-tracking-sdk-leads-to-account-takeover)
- [OpenReplay improper access control in Python API projectKey routes](https://junglewise.ai/threats/cve-2026-45296-openreplay-improper-access-control-in-python-api-projectkey)