CVE-2026-55880: fallo de gravedad alta en openreplay
OpenReplay: Cross-user IDOR in notes and dashboard widgets
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.3%
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user's private session notes and remove or rewrite widgets on another user's private dashboards.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Productos afectados
openreplay · openreplayCVEs relacionadas — openreplay
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-48226MEDIUMOpenReplay HTML Injection vulnerabilityEPSS 0.8%CVE-2026-55879CRITICALOpenReplay: Unauthenticated stored XSS leads to dashboard account takeoverEPSS 0.5%CVE-2026-55881HIGHOpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpointEPSS 0.4%CVE-2026-28443MEDIUMOpenReplay: SQL injection in cards/search via unvalidated sort field parameterEPSS 0.4%CVE-2026-57230MEDIUMOpenReplay: Authenticated ClickHouse SQL injection via session searchEPSS 0.3%CVE-2026-45296HIGHOpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant bindingEPSS 0.2%