The vulnerability CVE-2026-22104 in Hashtopolis server affects versions before 0.14.8. Due to improper access control in the chunk activity component of the web interface, any authenticated user with a created account can access and read all cracked hashes stored on the server. This constitutes an authorization bypass (CWE-639) that compromises confidentiality of sensitive data. The CVSS 4.0 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality with no impact on integrity or availability. No official patch or remediation level is currently documented, and no known exploits in the wild have been reported.

Any user with a created account on the vulnerable Hashtopolis server can read all cracked hashes, leading to unauthorized disclosure of sensitive credential data. This compromises confidentiality and may facilitate further attacks if the hashes are used maliciously. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict account creation and limit user access to trusted personnel only. Monitor for updates from Hashtopolis regarding a security patch for version 0.14.8 or later.