CVE-2026-55880

highCVSS 7.1covered by 1 sourcefirst seen 2026-07-10

OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user's private session notes and remove or rewrite widgets on another user's private dashboards.

⚡ Watch CVE-2026-55880

Get an email if CVE-2026-55880 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highCVE-2026-55880: OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and n…nvd · 2026-07-10

External references

NVD record for CVE-2026-55880

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-55880 status](https://www.csirts.com/badge/CVE-2026-55880)](https://www.csirts.com/cve/CVE-2026-55880)