CVE-2026-88891 Details

A vulnerability exists in OpenPanel versions 0 and above, where the application does not properly enforce read-only access levels on 26 out of 29 mutating procedures. This oversight allows members with read-only access to modify, delete, and publish project data. Specifically, attackers can exploit this flaw to delete reports and dashboards, schedule projects for deletion, publish private analytics via public share links, and alter alerting rules. The issue arises from a lack of proper access level validation in the mutation resolvers.

To address this vulnerability, the access level enforcement should be centralized in a middleware function that applies the correct permissions to all mutating procedures. Additionally, the 'getProjectAccess' function should be modified to return a consistent shape that includes the access level, eliminating the current ambiguity that allows for oversight in permission checks.