Description
OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Openpanel-dev | openpanel | ≤ 2.3.0 | — |