PT-2026-57328 · Openreplay · Openreplay

Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-55881

NVD

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob returned 15-second presigned S3 download URLs for a session's DOM-replay recording based solely on the session path parameter, while validateProjectAccess checked only that the project belonged to the requester's tenant and did not verify that the session belonged to that project, allowing any authenticated low-privilege user to read another tenant's first 15 seconds of session-replay recording data. This issue is fixed in version 1.27.0.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-55881

Produtos afetados

Openreplay

Referências · 5

• https://github.com/openreplay/openreplay/commit/ddd09117f644a309c7b040cda0a11ff9433e9e49 · Nota
• https://github.com/openreplay/openreplay/releases/tag/v1.27.0 · Nota
• https://github.com/openreplay/openreplay/security/advisories/GHSA-w2x5-m7w5-479h · Nota
• https://github.com/openreplay/openreplay/pull/4692 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-55881 · Nota de Segurança