EUVD-2026-110518

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant...

CVE-2026-116810

OpenPanel versions prior to 3.0.0 are affected by a missing authorization vulnerability in the public reference.getChartReferences tRPC procedure. This flaw allows unauthenticated attackers to read annotations from any project by using guessable slug-based project IDs. Impacted data includes cros...