CVE-2026-55880
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In OpenReplay versions 1.27.0 and earlier, three mutation functions (notes.delete, dashboards.update_widget, dashboards.remove_widget) did not check resource ownership, allowing any authenticated user to delete other users' private session notes and modify widgets on their private dashboards.
Risk Assessment
The risk is that any authenticated member can delete or modify private session data and widgets, potentially causing data loss and confidentiality breaches.
Recommendation
Upgrade OpenReplay to version 1.28.0 or later, which includes a fix that adds ownership checks to the mutation functions.
Other vulnerabilities in OpenReplay
See all- CVE-2026-55879Critical
OpenReplay versions 1.24.0 through 1.25.0 contain an XSS vulnerability allowing an unauthenticated attacker to take over a dashboard account. The attacker can inject a malicious script via custom event names or captured page URLs, which are stored in ClickHouse without output encoding and later rendered in the dashboard, enabling theft of the JWT token from localStorage.
- CVE-2026-57230Medium
A vulnerability in OpenReplay before version 1.27.0 allows an authenticated user to read any ClickHouse table via SQL injection in the session search and analytics API. The attacker can perform blind boolean and time-based data exfiltration and disrupt session search for all users.
- CVE-2026-55881High
A vulnerability in OpenReplay allows an authenticated low-privilege user to read the first 15 seconds of session replay data from another tenant. The issue stems from missing validation that the session belongs to the project when generating presigned download URLs.
Original NVD description (English source)
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user's private session notes and remove or rewrite widgets on another user's private dashboards.