Security Advisory

CVE-2026-55880

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-10 20:42:15

Last updated 2026-07-13 18:03:13

Assigner GitHub_M

CVSS score 7.1

State PUBLISHED

Description

OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user's private session notes and remove or rewrite widgets on another user's private dashboards.

← Browse all CVEs View on cve.org ↗