{"id":"CVE-2026-77769","title":"The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId)","summary":"The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId). The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-639"],"published":"2026-08-21","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:17:42.377","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77769","references":[{"url":"https://github.com/Openpanel-dev/openpanel","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Openpanel-dev/openpanel/blob/e8a0602cda5a4d4b463f11d298a1b078c446bf33/packages/trpc/src/routers/report.ts","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Openpanel-dev/openpanel/commit/0a51b6805eed0b3da8376175acd5fa3d26819cb6","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-3q95-vc6f-vc9v","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openpanel-report-list-queries-reports-by-an-unverified-dashboardid-crossing-organization-boundaries","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-3q95-vc6f-vc9v","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00243,"epssPercentile":0.15827,"ingestedAt":"2026-09-23T17:28:14.800Z","slug":"CVE-2026-77769","body":"## Overview\n\nThe report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId). The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied dashboardId belonged to that project, and getReportsByDashboardId in packages/db/src/services/reports.service.ts selects reports by dashboardId alone with no project scoping. An authenticated user could therefore pair a projectId from their own organization, which satisfies the middleware, with a dashboardId belonging to another organization and receive every report in that dashboard. A correctly scoped helper, listReportsCore, already existed in the same service file and resolves the dashboard through getDashboardById(dashboardId, projectId) before returning reports, but the router did not use it.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}