CVE-2026-22104: Hashtopolis Auth Bypass Vulnerability

CVE-2026-22104 Overview

CVE-2026-22104 is an improper access control vulnerability in the Hashtopolis server web-interface chunk activity component. Hashtopolis is a distributed password cracking coordination platform built on Hashcat. The flaw affects all versions prior to 0.14.8 and allows any authenticated account, regardless of role, to read all cracked hashes stored on a Hashtopolis server instance. The Dutch Institute for Vulnerability Disclosure (DIVD) coordinated the disclosure under advisory DIVD-2026-00010. The issue is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Any low-privileged account on a Hashtopolis instance can retrieve every cracked hash across the server, exposing recovered plaintext credentials collected from all users' cracking jobs.

Affected Products

Hashtopolis server versions prior to 0.14.8
Hashtopolis web-interface chunk activity component
Instances where multiple accounts share a single Hashtopolis server

Discovery Timeline

2026-07-17 - CVE-2026-22104 published to NVD
2026-07-17 - Last updated in NVD database
Hashtopolis v0.14.8 - Fixed release published by the Hashtopolis project

Technical Details for CVE-2026-22104

Vulnerability Analysis

Hashtopolis coordinates password cracking work by distributing hash lists into chunks that agents process. The web interface exposes a chunk activity view intended to show cracking progress. The vulnerability exists because this component does not enforce per-account authorization when returning cracked hash results. Any user that can authenticate to the instance can query the endpoint and receive the full set of recovered plaintexts, including those belonging to hash lists owned by other users or restricted to administrators.

The weakness maps to [CWE-639], where the application relies on client-supplied identifiers or view scoping without validating that the requesting account owns or is authorized to read the referenced hash list. Because Hashtopolis stores recovered plaintexts alongside chunk metadata, an authorization check omission in one view exposes the most sensitive data the server holds.

Root Cause

The root cause is a missing ownership and role check in the chunk activity component of the web interface. The code path returning chunk results does not restrict output to hash lists the requesting account is entitled to view. Access is granted on the basis of authentication alone rather than authorization against the target resource.

Attack Vector

Exploitation requires a valid account on the target Hashtopolis instance. In shared or multi-tenant deployments, an attacker who registers or is issued a low-privileged account browses the chunk activity view and reads cracked hashes across all hash lists. No user interaction from other accounts is required, and the attack can be performed entirely over the network against the web interface. See the DIVD advisory for CVE-2026-22104 for additional technical context.

Detection Methods for CVE-2026-22104

Indicators of Compromise

Access log entries showing low-privileged accounts requesting chunk activity endpoints associated with hash lists they do not own.
Unexpected volume of reads against chunk activity views from a single authenticated session.
New or rarely used accounts querying cracked hash data shortly after login.

Detection Strategies

Correlate Hashtopolis web server logs with account role data to flag reads of chunk activity for hash lists outside the account's ownership scope.
Alert on any non-admin account that retrieves cracked hash content across multiple distinct hash list identifiers in a short window.
Compare current Hashtopolis version reported by the instance against the fixed release 0.14.8 and treat lower versions as vulnerable.

Monitoring Recommendations

Enable and centralize HTTP access logging on the Hashtopolis reverse proxy or application server.
Monitor for account creation events followed by immediate access to chunk activity or cracked hash pages.
Track outbound data volumes from the web interface to detect bulk retrieval of recovered plaintexts.

How to Mitigate CVE-2026-22104

Immediate Actions Required

Upgrade all Hashtopolis server deployments to version 0.14.8 or later as published in the Hashtopolis v0.14.8 release.
Audit existing accounts and remove any that are no longer required or were not explicitly provisioned.
Rotate any credentials whose hashes were processed on a shared instance prior to patching, since cracked plaintexts may have been exposed.

Patch Information

The Hashtopolis project fixed the improper access control issue in version 0.14.8. The release is available on the project's GitHub repository. Administrators should follow the standard Hashtopolis upgrade procedure, back up the database before applying the update, and verify the running version after deployment. Refer to the DIVD-2026-00010 report for coordinated disclosure details.

Workarounds

Restrict Hashtopolis account creation to trusted administrators until the upgrade is applied.
Place the web interface behind an authenticated reverse proxy that limits access to a small set of operator IP addresses.
Segregate sensitive hash lists onto separate Hashtopolis instances so that account compromise does not expose cross-tenant data.

bash

# Verify Hashtopolis server version after upgrade
cd /path/to/hashtopolis/server
git fetch --tags
git checkout v0.14.8
grep -R "VERSION" src/inc/confHTServer.php