CVE-2026-88893: OpenPanel Unauthenticated Share Lookup Information Disclosure
OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any OpenPanel deployment that exposes share lookup procedures to callers with a share link is potentially exposed. No authentication is required to retrieve the disclosed data.
What does an attacker need to exploit it?
An attacker needs a share link. The attack is network-accessible, requires no privileges or user interaction, and can be used to obtain argon2id password hashes and protected report definitions.
What information can be obtained?
The affected lookup procedures can return password hashes and full report configurations. Report data can include event names, filters, and breakdown dimensions, which may expose business intelligence details.
What is the risk if hashes have already been disclosed?
The disclosed argon2id hashes can be subjected to offline password-cracking attempts. Organizations should treat exposed hashes as potentially available to attackers and assess the accounts or credentials protected by those hashes.