CVE-2026-116809
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 27, 2026
Vendor
unknown
Description
OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types, and paths for private or password-protected projects, revealing internal routes.