Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck

CVE-2026-88893OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure

High 7.5

In plain English

A high-severity information exposure in openpanel from Openpanel-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.

Affected products (as reported)

Vendor	Product	Versions
Openpanel-dev	openpanel	0 – through 2.3.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-7gv7-c464-9wh8) vendor-advisory
https://github.com/Openpanel-dev/openpanel/commit/5faad3226df8fe03bc9434dfd255afb3fcea4c83 patch
VulnCheck Advisory: OpenPanel Unauthenticated Share Lookup Information Disclosure third-party-advisory