OpenPanel CVE-2026-88893

Exploitation requires possession of a valid OpenPanel share link. Share links are the sole gating factor - no account credentials, session tokens, or additional authentication are required. The share link itself is not a high-entropy secret in practice: it may be embedded in emails, documentation, or dashboards and distributed to multiple recipients. Once a share link is in hand, exploitation is a single unauthenticated HTTP request with no special tooling. Exploitation is limited to: (1) deployments where the share/public link feature is in use - installations where no share links have ever been generated have no exploitable endpoint; (2) network reachability to the OpenPanel instance. There is no platform or OS restriction.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) accurately reflects the key risk dimensions: network-accessible, low complexity, no authentication required beyond share link possession, and high confidentiality impact. The confidentiality impact is bifurcated: argon2id hashes enable offline credential cracking (if cracked, leading to full account compromise), while report configurations represent business intelligence theft. Argon2id is a strong hash function resistant to GPU-based cracking, which somewhat mitigates the password hash exposure - the real-world success of cracking depends on password strength. EPSS data is not provided, and no KEV listing exists, suggesting no confirmed in-the-wild exploitation. The primary exploitation barrier is obtaining a share link, which is a weak gating factor since share links are commonly distributed via email or embedded in documents. The combination of zero-authentication requirement (given a share link) and credential hash exposure justifies treating this as a genuine priority for organizations using OpenPanel with shared reports.

An attacker who receives an OpenPanel share link - whether through legitimate distribution, email interception, or social engineering a legitimate user - sends a direct HTTP GET request to the share lookup API endpoint without any additional credentials. The server returns the full backend record, including the account owner's argon2id password hash and the complete report definition. The attacker extracts the password hash for offline cracking and harvests the report configuration to reconstruct proprietary analytics data (event taxonomies, funnel definitions, segmentation rules) belonging to the target organization.