CVE-2026-116814

OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

7.1 High

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and RESEND_API_KEY are unset.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.28%Unchanged since Oct 27, 2026

What each source reports

CVE List Score used 7.1

OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

Record: CVE-2026-116814
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-532
Updated: 2026-11-04

EUVDEUVD-2026-110522 7.1

Record: EUVD-2026-110522
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-04

GitHub AdvisoriesGHSA-3j3f-vrq7-3c85 7.1

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database...

Record: GHSA-3j3f-vrq7-3c85
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-532
Updated: 2026-11-02

NVD 7.1

Record: CVE-2026-116814
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-532
Updated: 2026-11-04

OSV 7.1

OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

Record: CVE-2026-116814
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-532
Updated: 2026-11-05

Affected products

openpanel-dev openpanel

History

History
Recorded	Changed	Sources
Nov 4, 2026	facts	EUVD
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-116814 is a high vulnerability (CVSS 7.1) in Openpanel-dev Openpanel, published October 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. No source names a fixed version.