CVE-2026-116814

MEDIUM 6.5

OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and RESEND_API_KEY are unset.

CWE	CWE-532
Vendor	openpanel-dev
Product	openpanel
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for openpanel-dev openpanel

Be the first to know when new medium vulnerabilities affecting openpanel-dev openpanel are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Openpanel-dev / openpanel

0 < 3.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-xr2x-w49w-hp2c github.com: https://github.com/Openpanel-dev/openpanel/commit/337b4ff8fe268c769a075a2e53206d54045cb2d5 github.com: https://github.com/Openpanel-dev/openpanel/commit/b197f024388060e37ef3b3dad43451a3d0a5d501 vulncheck.com: https://www.vulncheck.com/advisories/openpanel-before-3.0.0-sensitive-information-exposure-via-application-logs

Credits

🔍 shiv-shi