# CVE-2026-88893: OpenPanel unauthenticated share lookup information disclosure

Source: https://junglewise.ai/threats/cve-2026-88893-openpanel-unauthenticated-share-lookup-information-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88893 · Severity: high · CVSS 7.5 · Published 2026-09-10

OpenPanel is a web-based analytics and reporting platform that allows users to share dashboards and reports via links, optionally protected with passwords. The vulnerability allows unauthenticated attackers who possess a share link to retrieve sensitive information including argon2id password hashes and complete report configurations (event names, filters, breakdown dimensions). This enables offline password cracking attacks and theft of business intelligence, defeating the security controls the owner intended to put in place.

## Quick answers

**Is CVE-2026-88893 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88893 being exploited in the wild.

**How severe is CVE-2026-88893?** High severity, with a CVSS score of 7.5, published 10 September 2026.

**Which products and versions are affected?** Openpanel-dev OpenPanel >= 0.

**Is there a fix for CVE-2026-88893?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88893 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-88893?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an access control bypass in three unauthenticated TRPC procedures (share.report, share.dashboard, share.overview) that return share records without proper filtering. The root cause is use of Prisma's findUnique without a top-level select statement, combined with object spreading that exposes all scalar columns including the password hash. The share.report procedure has an additional defect: it unconditionally returns the full report configuration via transformReport() without validating the share.public flag or checking password authorization, returning hasAccess: false while leaking the protected configuration. An attacker with a share URL can exploit this over the network with no authentication or user interaction required. Chart data itself remains protected by validateShareAccess middleware, but the share record credentials and report metadata leak. No patch has been released as of the advisory date.

## Affected products

- Openpanel-dev OpenPanel >= 0

## Timeline

- 2026-08-26: disclosed: GitHub Security Advisory GHSA-7gv7-c464-9wh8 published
- 2026-09-10: advisory: CVE-2026-88893 published on NVD

## References

- [https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7gv7-c464-9wh8](https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7gv7-c464-9wh8)
- [https://www.vulncheck.com/advisories/openpanel-unauthenticated-share-lookup-information-disclosure](https://www.vulncheck.com/advisories/openpanel-unauthenticated-share-lookup-information-disclosure)