GHSA-5qj9-v45f-h548HighCVSS 8.4
Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication...
🔗 CVE IDs covered (1)
📋 Description
Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-77877
- https://control-webpanel.com/changelog
- https://www.vulncheck.com/advisories/control-web-panel-cwp-unauthenticated-loopback-api-root-access
- https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce
- https://github.com/advisories/GHSA-5qj9-v45f-h548