CVE-2026-22104 Details

A vulnerability exists in the Hashtopolis server web interface, specifically in the chunk activity component, for all versions prior to 0.14.8. This vulnerability allows any user account to access and read all cracked hashes from a Hashtopolis server instance, regardless of the user's assigned role or privileges. The issue stems from improper access control, which fails to restrict users from accessing hash information outside their designated access groups.

Users are advised to update Hashtopolis to version 0.14.8 or later, which addresses this vulnerability. After updating, it is recommended to review account access and remove any unnecessary accounts, especially those created for agent registration.