GHSA-h37h-2fv9-j4qwHighCVSS 7.5
OpenPanel share lookup procedures fail to validate access controls and return password hashes and...
🔗 CVE IDs covered (1)
📋 Description
OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.
🔗 References (5)
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7gv7-c464-9wh8
- https://nvd.nist.gov/vuln/detail/CVE-2026-88893
- https://www.vulncheck.com/advisories/openpanel-unauthenticated-share-lookup-information-disclosure
- https://github.com/Openpanel-dev/openpanel/commit/5faad3226df8fe03bc9434dfd255afb3fcea4c83
- https://github.com/advisories/GHSA-h37h-2fv9-j4qw