High severityNVD Advisory· Published Jul 17, 2026· Updated Jul 17, 2026

CVE-2026-22104

Description

Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hashtopolis server instance.

Affected products

Hashtopolis/Hashtopolisllm-fuzzy
Range: <0.14.8

Patches

Vulnerability mechanics

References

csirt.divd.nl/CVE-2026-22104nvd
csirt.divd.nl/DIVD-2026-00010nvd
github.com/hashtopolis/server/releases/tag/v0.14.8nvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000