An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users.