---
id: CVE-2026-88891
title: >-
  OpenPanel through 2.3.0 fails to enforce read-only project access level on 26
  of 29 mutating procedures, allowing read-level members to modify, delete, and
  publish project data
summary: >-
  OpenPanel through 2.3.0 fails to enforce read-only project access level on 26
  of 29 mutating procedures, allowing read-level members to modify, delete, and
  publish project data. Attackers with explicit read-only access can delete
  reports…
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H'
cwe:
  - CWE-269
vendor: Openpanel-dev
product: openpanel
affected:
  - openpanel <= 2.3.0
published: '2026-09-10'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T15:17:12.153'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88891'
references:
  - url: >-
      https://github.com/Openpanel-dev/openpanel/commit/5faad3226df8fe03bc9434dfd255afb3fcea4c83
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-f9rx-pxgw-c6rg
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openpanel-read-only-access-level-enforcement-bypass-via-mutations
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-f9rx-pxgw-c6rg
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T14:25:18.502698Z'
epss: 0.00441
epssPercentile: 0.38161
ingestedAt: '2026-09-13T14:47:15.814Z'
---

## Overview

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.