CVE-2026-116806 Details

A missing authorization vulnerability has been identified in OpenPanel versions prior to 3.0.0, specifically within the onboarding.project tRPC mutation. This vulnerability allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the established admin-only policy. Exploitation of this vulnerability enables attackers to repeatedly call the endpoint using a member session to obtain plaintext secrets, inject fake analytics events, disrupt business metrics, and consume the organization's usage budget.

To address this vulnerability, OpenPanel users can require organization admin privileges for the onboarding.project mutation, aligning it with the existing project.create and client.create procedures that already enforce this requirement. Self-hosted operators can also audit member roles and rotate unexplained credentials via the client.remove function, which is admin-gated.