OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft, enabling attackers to crack passwords offline and extract sensitive business intelligence.

OpenPanel version 2.3.0 and earlier are affected, as the vulnerability is limited to releases up to and including 2.3.0. Administrators should verify whether their deployment exposes the share lookup endpoint and determine if a remedial update is available from Openpanel‑dev. If a fix is not yet released, consider disabling the share lookup feature or imposing authentication requirements.

With a CVSS score of 8.7, the vulnerability is classified as high‑severity. The EPSS score is less than 1% (approximately 0.00432), indicating a low probability of exploitation in the wild, but the flaw is trivial to trigger via an unauthenticated share link. The lack of a KEV listing does not diminish the threat; attackers can freely abuse the information disclosure to facilitate credential theft and compromise of confidential reports.