Description
Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hashtopolis server instance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hashtopolis | server | < 0.14.8 | 0.14.8 |
References
- https://csirt.divd.nl/CVE-2026-22104 third-party-advisory
- https://csirt.divd.nl/DIVD-2026-00010 third-party-advisory
- https://github.com/hashtopolis/server/releases/tag/v0.14.8 vendor-advisory