CVE-2026-55881: fallo de gravedad alta en openreplay
OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.4%
OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob returned 15-second presigned S3 download URLs for a session's DOM-replay recording based solely on the session path parameter, while validateProjectAccess checked only that the project belonged to the requester's tenant and did not verify that the session belonged to that project, allowing any authenticated low-privilege user to read another tenant's first 15 seconds of session-replay recording data. This issue is fixed in version 1.27.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
openreplay · openreplayCVEs relacionadas — openreplay
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-48226MEDIUMOpenReplay HTML Injection vulnerabilityEPSS 0.8%CVE-2026-55879CRITICALOpenReplay: Unauthenticated stored XSS leads to dashboard account takeoverEPSS 0.5%CVE-2026-28443MEDIUMOpenReplay: SQL injection in cards/search via unvalidated sort field parameterEPSS 0.4%CVE-2026-57230MEDIUMOpenReplay: Authenticated ClickHouse SQL injection via session searchEPSS 0.3%CVE-2026-55880HIGHOpenReplay: Cross-user IDOR in notes and dashboard widgetsEPSS 0.3%CVE-2026-45296HIGHOpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant bindingEPSS 0.2%