CVE-2026-88893CWE-200information-disclosure

CVE-2026-88893

High · published September 10, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.3
In the wild
Unconfirmed
What it is

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00492 · 41.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-10T18:17Z
References (3)
https://github.com/Openpanel-dev/openpanel/commit/5faad3226df8fe03bc9434dfd255afb3fcea4c83 · [email protected]https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7gv7-c464-9wh8 · [email protected]https://www.vulncheck.com/advisories/openpanel-unauthenticated-share-lookup-information-disclosure · [email protected]
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 13:05Z
    OpenPanel Unauthenticated Share Lookup Information Disclosure
    cvelistv5