Which versions of Hashtopolis are affected by CVE-2026-22104?

Hashtopolis server versions prior to 0.14.8 contain a broken authorization flaw that exposes all recovered plaintext credentials to any authenticated user, regardless of their assigned access group…. A patch is available.

How to fix or mitigate CVE-2026-22104?

Within 24 hours, audit all Hashtopolis server instances to identify their current version and production deployment status. Within 7 days, upgrade all affected instances to version 0.14.8 or later, which contains the vendor-released authorization fix. Within 30 days, review access logs to identify any unauthorized credential access during the affected period, implement credential rotation for any recovered passwords confirmed compromised, and validate that access controls are functioning correctly post-upgrade.

Hashtopolis CVE-2026-22104

Q: What is the CVSS score of CVE-2026-22104?

CVE-2026-22104 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:I/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45155 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-17 DIVD

GHSA-mr39-qwfq-3rmh

Authentication Bypass Server Hashtopolis

7.1

CVSS 4.0 · Vendor: DIVD

Severity by source

Vendor (DIVD) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:I/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Any authenticated account exploits it remotely with low complexity (PR:L, AC:L, AV:N); impact is confidentiality-only disclosure of cracked hashes, so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DIVD).

CVSS VectorVendor: DIVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 11:17 EUVD

Source Code Evidence Fetched

Jul 17, 2026 - 10:15 vuln.today

Analysis Generated

Jul 17, 2026 - 10:15 vuln.today

CVE Published

Jul 17, 2026 - 09:30 cve.org

HIGH 7.1

DescriptionCVE.org

Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hashtopolis server instance.

AnalysisAI

Broken object-level authorization in the Hashtopolis server web-interface chunk activity component lets any authenticated low-privilege account read all cracked hashes across the entire server, regardless of access-group membership. Affecting all versions prior to 0.14.8, the flaw exposes recovered plaintext credentials - the core sensitive output of the platform - to users who should only see their own group's data. No public exploit is identified at time of analysis, but the vendor confirmed the issue and shipped a fix in v0.14.8.

Technical ContextAI

Hashtopolis is an open-source, distributed hashcat wrapper that coordinates password-cracking work across multiple agents, splitting jobs into 'chunks' and storing recovered plaintext hashes centrally. The vulnerability sits in the web interface's chunk activity component, where cracked-hash and chunk information is meant to be segregated by access group. The root cause maps to CWE-639 (Authorization Bypass Through User-Controlled Key, i.e. an IDOR-class flaw): the component fails to enforce that the requesting user is a member of the access group owning the chunk/hash data, so a user-supplied identifier is trusted without an ownership check. The affected component is captured by CPE cpe:2.3:a:hashtopolis:server:*, covering the server product across all versions below the fixed 0.14.8 release.

RemediationAI

Upgrade to the vendor-released patch: Hashtopolis server v0.14.8 (https://github.com/hashtopolis/server/releases/tag/v0.14.8), which the release notes state fixes access issues where users could read chunk and hash info from access groups they were not members of. Until the upgrade is applied, reduce exposure by restricting who can hold accounts on the instance: disable or freeze creation of new low-trust accounts, and audit existing accounts to remove any that should not have access to cracked-hash data (trade-off: may interrupt legitimate collaborators). Because the web interface is the attack surface, place the Hashtopolis server behind network access controls or a VPN so only trusted operators can reach it (trade-off: complicates distributed-agent connectivity if agents traverse the same interface). For multi-tenant or shared deployments, consider segregating sensitive cracking jobs onto separate single-team instances until patched, since the flaw exposes all cracked hashes regardless of group. Additional advisory context is available from DIVD at https://csirt.divd.nl/DIVD-2026-00010.