CVE-2026-88893
Last modified
CVE-2026-88893 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft..
Description
OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Openpanel-dev | openpanel | <= worker |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-88893?
How severe is CVE-2026-88893?
How do I fix CVE-2026-88893?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-88888Renovate before 44.14.7 contains a command injection vulnera…7
- CVE-2026-88889Renovate before 44.14.7 contains a command injection vulnera…7.8
- CVE-2026-8889Version 3.0.7 of the Securly Chrome Extension uses deprecate…7.5
- CVE-2026-88890OpenPanel through commit cd24bb8 contains an SQL injection v…8.5
- CVE-2026-88891OpenPanel fails to enforce read-only project access level on…8.3
- CVE-2026-88892OpenPanel is an analytics platform. In all versions (no patc…5
- CVE-2026-88894Snipe-IT's predefined kit checkout path does not enforce Ful…5.4
- CVE-2026-88895CyberPanel before 3.0.5 fails to enforce two-factor authenti…7.2
- CVE-2026-88896EspoCRM before 10.0.4 is vulnerable to server-side request f…5.3
- CVE-2026-88897Flextype CMS through 1.0.0-alpha.3 accepts API authenticatio…5.9
- CVE-2026-88898AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authori…6.5
- CVE-2026-88899knowns versions before 0.31.0 fail to properly validate the …9.8
Are you affected by CVE-2026-88893?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST