Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ (OSS api/auth/auth_project.py:14-38 and EE ee/api/auth/auth_project.py:14-46) only runs projects.is_authorized(project_id, tenant_id, user_id) + projects.get_project(tenant_id, project_id) when self.project_identifier == "projectId" (camelCase). For EE multi-tenant, feature-flag queries only filter on project_id, never tenant_id. Any authenticated user in tenant A can read/update/delete feature-flag rows belonging to tenant B by iterating the sequential integer project_id + feature_flag_id. OSS is single-tenant by design ({"errors":["tenants already registered"]} on second signup) so there's no cross-tenant impact This vulnerability is fixed in 1.26.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-45297 OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch… https://www.cve.org/CVERecord?id=CVE-2026-45297
Post summary
The CVE-2026-45297 vulnerability is a cross‑tenant IDOR in OpenReplay before version 1.26.0, with a patch implied by the release of that version.
CVE-2026-45297 Cross-Tenant IDOR in OpenReplay via Project ID Case Mismatch Below 1.26.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45297
Post summary
The CVE-2026-45297 describes a cross-tenant IDOR vulnerability in OpenReplay versions below 1.26.0 caused by a project ID case mismatch; no PoC, exploit, or patch information is furnished.
🚨*CVE* CVE-2026-45297 OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch… https://www.cve.org/CVERecord?id=CVE-2026-45297 ----- Traducción: CVE-2026-45297 Ope… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑45297, a cross‑tenant IDOR vulnerability in OpenReplay before v1.26.0 that impacts feature‑flag and assist‑stats routes, with a link to the official CVE record.