CVE-2026-77769 — OpenPanel report.list queries reports by an unverified dashboardId, crossing organization boundaries

OpenPanel’s report.list procedure allowed an authenticated user to combine a projectId from their own organization with a dashboardId from another organization and receive every report in that dashboard.