Privilege escalation in Openpanel-Dev Openpanel
CVE-2026-88891
OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (37.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.001
Affected products
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-88891?
- CVE-2026-88891 is a high-severity vulnerability in Openpanel-Dev Openpanel, classified under Improper Privilege Management. CVSS score: 8.3/10. Published 2026-09-10.
- How severe is CVE-2026-88891?
- High severity. CVSS v3 base score is 8.3 out of 10.