EUVD-2026-63902

The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardIddashboardId. The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied...

CVE-2026-77769

OpenPanel 's report.list tRPC procedure contained a cross-organization authorization bypass . The enforceAccess middleware verified membership for the supplied projectId, but the dashboardId parameter was never validated against that project. The underlying getReportsByDashboardId query selected ...