CVE-2026-88891

OpenPanel, an open-source analytics platform with projects, reports, dashboards, and alerting, fails to enforce the read-only project access level in 26 of its 29 mutation procedures, a missing-authorization flaw (CWE-269). The flaw is triggered by any authenticated member holding only read-level project access who invokes one of the affected mutating API operations, because the mutation resolvers skip access-level validation. Such an attacker can delete reports and dashboards, schedule an entire project for deletion, publish private analytics to public share links, and alter alerting rules, giving them significant integrity and availability impact (CVSS 4.0: 7.2 High) without needing any additional privileges. Anyone running OpenPanel who has granted read-only project access to other users is affected, since the attacker must be a legitimate low-privileged member. There is no evidence of exploitation in the wild, no public proof-of-concept, and the issue is not in CISA's KEV catalog.

What to do: Until a patched release is identified, audit project member lists and limit read-only invitations to fully trusted users, and review projects for unexpected edits or deletions, scheduled project deletions, newly created public share links, and modified alerting rules. Watch the vendor's release channel for a fix addressing mutation-level access validation, since no fixed version is stated in the current data.