PT-2026-89404

CVE-2026-88893

Published

2026-09-10

Updated

2026-09-10

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to 2.3.0

Description Share lookup procedures fail to validate access controls, allowing unauthenticated callers to retrieve protected report definitions and argon2id password hashes. Attackers possessing a share link can obtain full report configurations, including filters, event names, and breakdown dimensions, which may lead to business intelligence theft and offline password cracking.

Recommendations Update to version 2.3.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

5Ud0Er

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers