CVE-2026-88893 Details

A vulnerability exists in OpenPanel's share lookup procedures, which fail to properly validate access controls. This flaw allows unauthenticated callers to access password hashes and protected report definitions. Specifically, attackers with a share link can obtain argon2id password hashes and detailed report configurations, including event names, filters, and breakdown dimensions. Such information can be exploited for offline password cracking and business intelligence theft. The vulnerability affects OpenPanel versions 0 and above.

To address this vulnerability, share lookup procedures should be modified to include explicit projections that exclude the password column from the response. Additionally, access controls should be enforced in the 'share.report' procedure to ensure that only authorized users can access protected content.