Executive brief
OpenPanel is an open-source analytics platform that stores saved reports containing configuration data like event series, filters, and formulas. A flaw in the report.get API endpoint allows any authenticated user to view the complete configuration of any saved report on the instance by supplying only the report ID, bypassing authorization checks that should verify the user has access to the report's parent project.
Technical details
The report.get procedure in packages/trpc/src/routers/report.ts accepts only a reportId parameter and calls getReportById(reportId) directly without project scoping. The enforceAccess middleware in packages/trpc/src/trpc.ts only evaluates membership when input contains projectId or organizationId keys; an input with reportId alone bypasses this check. The underlying getReportById service in packages/db/src/services/reports.service.ts performs an unscoped findUnique query on the report ID. An authenticated attacker can enumerate or guess report IDs to read sensitive report metadata including owning projectId, event series, filters, breakdowns, and formulas. Related procedures (update, delete, duplicate) correctly perform project access checks after fetching the report, making this omission specific to the get endpoint. A patch adding projectId validation to the report.get procedure would mitigate the issue.
Affected products
- Openpanel-dev OpenPanel <UNKNOWN>
Timeline
- 2026-08-21: disclosed