CVE-2026-88893

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to 2.3.0

Description Share lookup procedures fail to validate access controls, allowing unauthenticated callers to retrieve protected report definitions and argon2id password hashes. Attackers possessing a share link can obtain full report configurations, including filters, event names, and breakdown dimensions, which may lead to business intelligence theft and offline password cracking.

Recommendations Update to version 2.3.0 or later.