| Package | Affected versions | Patched versions |
|---|---|---|
| No affected product versions are listed for this vulnerability yet. | ||
OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a member session to obtain plaintext secrets, inject fake analytics events, poison business metrics, and consume the organization's usage budget.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free