Is CVE-2026-77768 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77768 being exploited in the wild.

How severe is CVE-2026-77768?

Medium severity, with a CVSS score of 6.5, published 21 August 2026.

Is there a fix for CVE-2026-77768?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77768 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-77768?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77768: OpenPanel report.get authorization bypass

CVE-2026-77768 · Severity: medium · CVSS 6.5 · Published 2026-08-21

OpenPanel is an open-source analytics platform that stores saved reports containing configuration data like event series, filters, and formulas. A flaw in the report.get API endpoint allows any authenticated user to view the complete configuration of any saved report on the instance by supplying only the report ID, bypassing authorization checks that should verify the user has access to the report's parent project.

Quick answers

Is CVE-2026-77768 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77768 being exploited in the wild.
How severe is CVE-2026-77768?: Medium severity, with a CVSS score of 6.5, published 21 August 2026.
Which products and versions are affected?: Openpanel-dev OpenPanel <UNKNOWN>.
Is there a fix for CVE-2026-77768?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77768 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-77768?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The report.get procedure in packages/trpc/src/routers/report.ts accepts only a reportId parameter and calls getReportById(reportId) directly without project scoping. The enforceAccess middleware in packages/trpc/src/trpc.ts only evaluates membership when input contains projectId or organizationId keys; an input with reportId alone bypasses this check. The underlying getReportById service in packages/db/src/services/reports.service.ts performs an unscoped findUnique query on the report ID. An authenticated attacker can enumerate or guess report IDs to read sensitive report metadata including owning projectId, event series, filters, breakdowns, and formulas. Related procedures (update, delete, duplicate) correctly perform project access checks after fetching the report, making this omission specific to the get endpoint. A patch adding projectId validation to the report.get procedure would mitigate the issue.

Affected products

Openpanel-dev OpenPanel <UNKNOWN>

Timeline

2026-08-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.