# CVE-2026-85611: OpenPanel cross-tenant broken object level authorization in report procedures

Source: https://junglewise.ai/threats/cve-2026-85611-openpanel-cross-tenant-broken-object-level-authorization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85611 · Severity: medium · CVSS 6.4 · Published 2026-09-04

OpenPanel is a web analytics and dashboard platform that allows organizations to create and manage reports. Two API procedures (report.getLayouts and report.resetLayout) fail to properly verify that a user has access to a specific dashboard before reading or deleting its configuration. An authenticated attacker can guess another organization's dashboard name and use it to read sensitive report definitions or permanently delete dashboard layouts belonging to other organizations, bypassing multi-tenant isolation controls.

Technologies: [OpenPanel](https://junglewise.ai/threats/technologies/openpanel). Vendors: [OpenPanel](https://junglewise.ai/threats/vendors/openpanel).

## Quick answers

**Is CVE-2026-85611 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85611 being exploited in the wild.

**How severe is CVE-2026-85611?** Medium severity, with a CVSS score of 6.4, published 4 September 2026.

**Which products and versions are affected?** OpenPanel before 2.3.0.

**Is there a fix for CVE-2026-85611?** A patch was published on 2026-09-04: Fixed in version 2.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85611 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85611?** Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a cross-tenant broken object level authorization (BOLA) vulnerability in two tRPC procedures within the OpenPanel API. The procedures accept a caller-supplied projectId and dashboardId, verify the caller has access to the projectId, but then query the database by dashboardId alone without binding it back to the supplied project. This allows an authenticated attacker from one organization to access dashboards belonging to other organizations by supplying their own (access-checked) projectId alongside a victim organization's guessable dashboardId. Dashboard IDs are human-readable slugs derived from dashboard names (e.g., "revenue-overview"), making them enumerable. An attacker needs only a basic authenticated account in any organization—no elevated privileges required. The vulnerability affects report.getLayouts (read) and report.resetLayout (mutation, which destructively deletes layout data). Patching was incomplete; a prior commit added tenant scoping to sibling procedures (report.list and report.get) but omitted it from getLayouts and resetLayout. A fix is available in version 2.3.0 and later.

## Affected products

- OpenPanel OpenPanel before 2.3.0

## Timeline

- 2026-08-20: disclosed: GitHub security advisory GHSA-g3xf-pqfp-22v7 published
- 2026-09-04: advisory: NVD entry published for CVE-2026-85611
- 2026-09-04: patched: Fixed in version 2.3.0

## References

- [https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-g3xf-pqfp-22v7](https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-g3xf-pqfp-22v7)
- [https://www.vulncheck.com/advisories/openpanel-before-2.3.0-cross-tenant-bola-via-report-procedures](https://www.vulncheck.com/advisories/openpanel-before-2.3.0-cross-tenant-bola-via-report-procedures)

## Related threats

- [OpenPanel ClickHouse SQL injection](https://junglewise.ai/threats/cve-2026-116818-openpanel-before-3-0-0-contains-an-unauthenticated-clickhouse)
- [OpenPanel missing authentication in Bull Board](https://junglewise.ai/threats/cve-2026-116817-openpanel-before-3-0-0-contains-a-missing-authentication)
- [OpenPanel improper escaping in sankey.service.ts](https://junglewise.ai/threats/cve-2026-116815-openpanel-before-3-0-0-contains-an-improper-escaping)
- [OpenPanel information exposure through logs](https://junglewise.ai/threats/cve-2026-116814-openpanel-before-3-0-0-contains-an-information-exposure)
- [OpenPanel SQL injection in cohort profile filter](https://junglewise.ai/threats/cve-2026-116812-openpanel-before-3-0-0-contains-a-sql-injection-vulnerability-in)