What’s Vulnerable › Vulnerabilities

CVE-2026-88893: OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-10 · updated 2026-10-27
• Weakness: CWE-200

Description

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.

Affected products

• Openpanel-dev openpanel: through 2.3.0

References

• https://github.com/Openpanel-dev/openpanel/commit/5faad3226df8fe03bc9434dfd255afb3fcea4c83
• https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7gv7-c464-9wh8
• https://www.vulncheck.com/advisories/openpanel-unauthenticated-share-lookup-information-disclosure

Get alerted when CVE-2026-88893 or the next vulnerability affects your stack