Live › vulnerability › CVE-2026-111627
Go to dashboardHestiaCP before 1.10.5 lets a non-ROOT_USER administrator impersonate the protected ROOT_USER account through the loginas parameter and still perform write actions. By posting to /add/cron/, the attacker gets crond to run commands as that protected administrator's system account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Servers running HestiaCP before 1.10.5 that have more than one administrator account are exposed. Single-admin installs where only the ROOT_USER account exists are unlikely to be affected, since the risk is a non-root admin reaching the protected account. unknown whether managed hosting variants are affected.
No product ranges from the sources yet.
1.10.5.1.10.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.
This page as .md · .json · in your agent: get_signal("CVE-2026-111627")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.