CVE-2026-45297 Details
Description
OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ (OSS api/auth/auth_project.py:14-38 and EE ee/api/auth/auth_project.py:14-46) only runs projects.is_authorized(project_id, tenant_id, user_id) + projects.get_project(tenant_id, project_id) when self.project_identifier == "projectId" (camelCase). For EE multi-tenant, feature-flag queries only filter on project_id, never tenant_id. Any authenticated user in tenant A can read/update/delete feature-flag rows belonging to tenant B by iterating the sequential integer project_id + feature_flag_id. OSS is single-tenant by design ({"errors":["tenants already registered"]} on second signup) so there's no cross-tenant impact This vulnerability is fixed in 1.26.0.
A cross-tenant Insecure Direct Object Reference (IDOR) vulnerability has been identified in OpenReplay versions prior to 1.26.0. This issue arises in the feature-flag and assist-stats routes due to a case mismatch in the project_id parameter. In the ProjectAuthorizer.__call__ method, the authorization checks are only performed when the project identifier is set to 'projectId' (camelCase). In the Enterprise Edition (EE) multi-tenant environment, feature-flag queries only consider the project_id, ignoring the tenant_id. As a result, an authenticated user in one tenant can access, modify, or delete feature-flag data belonging to another tenant by sequentially iterating through project and feature flag IDs. Additionally, the assist-stats routes can unintentionally expose cross-tenant session analytics. This vulnerability does not affect the OpenReplay Open Source (OSS) version, which is designed to be single-tenant.
Users can upgrade to OpenReplay version 1.26.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openreplay/openreplay/security/advisories/GHSA-5m23-rcj4-cgjx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenReplay | <= 1.23.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |