PT-2026-44458 · Unknown · Openreplay

Sajdakabir · Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-45297

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions OpenReplay versions prior to 1.26.0

Description An Insecure Direct Object Reference (IDOR) exists in the self-hosted session replay suite due to a case mismatch in the project id variable. In the Enterprise Edition (EE) multi-tenant environment, the ProjectAuthorizer. call function (located in api/auth/auth project.py and ee/api/auth/auth project.py) only performs authorization checks when the project identifier is in camelCase (projectId). Consequently, queries for the 'feature-flag' and 'assist-stats' routes filter only by project id and ignore the tenant id. This allows an authenticated user from one tenant to read, update, or delete feature-flag data belonging to another tenant by iterating through sequential integer values of project id and feature flag id.

Recommendations Update to version 1.26.0.

Fix

IDOR

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-285

CWE-863

Related Identifiers

CVE-2026-45297

Affected Products

Openreplay

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-45297 · Security Note
• https://github.com/openreplay/openreplay/security/advisories/GHSA-5m23-rcj4-cgjx · Note
• https://twitter.com/infoflowcloud/status/2060093087225950248 · Twitter Post
• https://twitter.com/CVEnew/status/2060091987907301843 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2060115373706412099 · Twitter Post