CVE-2026-88893

CVE-2026-88893 is an information disclosure flaw in OpenPanel's share lookup procedures, which fail to enforce access controls before returning protected data. An unauthenticated attacker who obtains or knows a share link can call the share lookup endpoint and receive argon2id password hashes as well as full report configurations, including event names, filters, and breakdown dimensions. With the exposed argon2id hashes, an attacker can attempt offline password cracking, and the leaked report definitions disclose business intelligence such as tracked events and how dashboards are segmented. Any OpenPanel deployment with dashboard or report sharing enabled is affected, since no authentication or privilege is required beyond access to a share link. As of this analysis there is no entry in CISA's KEV catalog and no public proof-of-concept, so exploitation is not confirmed.

What to do: Monitor the vendor for a patched release and upgrade as soon as a fixed version is announced, since the disclosure does not specify affected version ranges. Until patched, audit or disable public share links, and check access logs for unauthenticated requests to share lookup endpoints. Rotate any dashboard/user passwords whose argon2id hashes may have been exposed through share links, as they could be cracked offline.