CVE-2026-116806 | BDVDB-2026-396142 Detail

Description#

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a member session to obtain plaintext secrets, inject fake analytics events, poison business metrics, and consume the organization's usage budget.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-26Record published in the CVE List.
2. Version 22026-11-04Most recent update recorded in the CVE List.