Executive brief
Hashtopolis is a central management tool for distributed password cracking. A security flaw in the server's web interface allows any user with a valid account to view all cracked passwords (hashes) across the entire system, even those belonging to other groups. This could lead to the unauthorized exposure of sensitive recovered credentials and compromise the privacy of different teams using the same server.
Technical details
An authorization bypass vulnerability (CWE-639) exists in the Hashtopolis server's chunk activity component. The root cause is improper access control where the application fails to validate if the authenticated user belongs to the specific access group associated with a chunk or hash. A remote attacker with low-privileged user credentials can exploit this by manipulating identifiers in the web interface to retrieve sensitive hash information from other groups. This issue is resolved in version 0.14.8, which introduces proper ACL checks for chunk and hash entities.
Affected products
- Hashtopolis Hashtopolis Server prior to 0.14.8
Timeline
- 2026-04-15: patched: Version 0.14.8 released to address access issues.
- 2026-07-17: disclosed: CVE-2026-22104 published.