CERT24CVE-2026-77768 — OpenPanel report.get Returns Any Report by Identifier Without Checking Project AccessLoading data…
CERT24Threat Observatory
Period

CVE-2026-77768 — OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

The OpenPanel report.get procedure accepted only a report identifier and returned the report without checking project access. As a result, any authenticated user could read the full configuration of saved reports on the instance if they supplied a report identifier.

← Back to intelligence

CVE-2026-77768 — OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

The OpenPanel report.get procedure accepted only a report identifier and returned the report without checking project access. As a result, any authenticated user could read the full configuration of saved reports on the instance if they supplied a report identifier.