CVE-2017-11681: Project Hashtopussy Hashtopussy

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Incorrect Access Control vulnerability in Hashtopussy 0.4.0 allows remote authenticated users to execute actions that should only be available for administrative roles, as demonstrated by an action=createVoucher request to agents.php.

Affected products

• Project Hashtopussy Hashtopussy: up to and including 0.4.0

Published 2017-07-27. Last modified 2026-06-17.