CVE-2026-116810
OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotation
CVSS
5.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 27, 2026 · Last modified: Oct 27, 2026 · CWE-639
Not enough EPSS history yet.
OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant annotation titles, descriptions, and dates such as release notes and deploy markers.
- github.comhttps://github.com/Openpanel-dev/openpanel/commit/7b88523798dcd2dcba53c39ca00f8a8c448377c3
- github.comhttps://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-c98x-mph7-r6vp
- github.comhttps://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-vrrm-p9p4-2gfg
- www.vulncheck.comhttps://www.vulncheck.com/advisories/openpanel-before-3.0.0-missing-authorization-via-reference-getchartreferences
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-22705.9 MED—
———A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.8hCVE-2026-1167465.3 MED—
———QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.10hCVE-2026-1167456.5 MED—
———QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.10hCVE-2026-1158046.4 MED—
———HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.12hCVE-2026-1157488.8 HIG—
———**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions.
Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.15hCVE-2026-1163404.3 MED—
———A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.14h