CVE-2026-55880highCWE-639

CVE-2026-55880: falha de alta gravidade em openreplay

OpenReplay: Cross-user IDOR in notes and dashboard widgets

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar openreplay

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.3%
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user's private session notes and remove or rewrite widgets on another user's private dashboards.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Produtos afetados
openreplay · openreplay
CVEs relacionadas — openreplay

No mesmo produto, das mais perigosas para as menos.

CVE-2023-48226MEDIUMOpenReplay HTML Injection vulnerabilityEPSS 0.8%CVE-2026-55879CRITICALOpenReplay: Unauthenticated stored XSS leads to dashboard account takeoverEPSS 0.5%CVE-2026-55881HIGHOpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpointEPSS 0.4%CVE-2026-28443MEDIUMOpenReplay: SQL injection in cards/search via unvalidated sort field parameterEPSS 0.4%CVE-2026-57230MEDIUMOpenReplay: Authenticated ClickHouse SQL injection via session searchEPSS 0.3%CVE-2026-45296HIGHOpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant bindingEPSS 0.2%