CVE-2026-88893 describes a security flaw in openpanel by Openpanel-dev where share lookup procedures fail to enforce access controls. This allows unauthenticated attackers possessing a share link to retrieve sensitive data including argon2id password hashes and full report configurations such as event names, filters, and breakdown dimensions. The exposure enables offline password cracking attempts and unauthorized access to business intelligence data. The vulnerability is remotely exploitable over the network without requiring privileges or user interaction, resulting in a high impact on confidentiality.

The vulnerability exposes sensitive password hashes and protected report data to unauthorized actors, enabling offline password cracking and theft of business intelligence. This compromises user credential confidentiality and the confidentiality of sensitive report configurations, potentially leading to further unauthorized access or data misuse.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, restrict access to share links and monitor for unauthorized access attempts.