CVE-2026-45297

OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ (OSS api/auth/auth_project.py:14-38 and EE ee/api/auth/auth_project.py:14-46) only runs projects.is_authorized(project_id, tenant_id, user_id) + projects.get_project(tenant_id, project_id) when self.project_identifier == "projectId" (camelCase). For EE multi-tenant, feature-flag queries only filter on project_id, never tenant_id. Any authenticated user in tenant A can read/update/delete feature-flag rows belonging to tenant B by iterating the sequential integer project_id + feature_flag_id. OSS is single-tenant by design ({"errors":["tenants already registered"]} on second signup) so there's no cross-tenant impact This vulnerability is fixed in 1.26.0.

• CWE-285
• CWE-639
• CWE-863

• https://github.com/openreplay/openreplay/security/advisories/GHSA-5m23-rcj4-cgjx

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45291Cloudburst Network provides network components used within C…7.5
• CVE-2026-45292opentelemetry-java is the Java implementation of the OpenTel…5.3
• CVE-2026-45293WordPress Coding Standards is a set of PHP_CodeSniffer rules…8.6
• CVE-2026-45294FreeScout is a free help desk and shared inbox built with PH…5.3
• CVE-2026-45295FreeScout is a free help desk and shared inbox built with PH…6.5
• CVE-2026-45296OpenReplay is a self-hosted session replay suite. Prior to 1…7.7
• CVE-2026-45298Dozzle is a realtime log viewer for docker containers. Prior…8.6
• CVE-2026-45299Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2026-4530A security flaw has been discovered in apconw Aix-DB up to 1…5.3
• CVE-2026-45300The AsyncHttpClient (AHC) library allows Java applications t…7.4
• CVE-2026-45301Open WebUI is a self-hosted artificial intelligence platform…8.1
• CVE-2026-45302parse-nested-form-data is a tiny node module for parsing For…8.2