CVE-2026-116809 OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116809?
CVE-2026-116809 is a medium-severity vulnerability in Openpanel-dev openpanel, published on 26 Oct 2026.
Official description
OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types, and paths for private or password-protected projects, revealing internal routes.
Weakness: CWE-284
Which versions are affected by CVE-2026-116809?
How do I fix CVE-2026-116809?
No fix has been published for CVE-2026-116809 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116809 being exploited?
There is no known exploitation of CVE-2026-116809 in the wild and no public exploit code.
Sources
Also known as GHSA-6gm2-h9rv-g3p8, GHSA-r4g5-vgpj-923m.