CyberRota Analysis
AI-GeneratedOpenReplay versions 1.27.0 and earlier contain a vulnerability in the dashboard and note mutation functions, allowing authenticated users to delete private session notes and modify widgets on other users' dashboards due to insufficient access controls. The impact is significant, as it enables unauthorized data manipulation, potentially leading to data loss and privacy breaches. Organizations using OpenReplay should prioritize addressing this vulnerability to safeguard user data and maintain the integrity of their session replay functionalities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user's private session notes and remove or rewrite widgets on another user's private dashboards.