{"id":"CVE-2026-124020","kind":"vulnerability","aliases":["CVE-2026-124020"],"related":[],"title":"Control Web Panel: password reset host header flaw enables account takeover","description":"Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account.","summary":"Control Web Panel (CWP) before webpanel_version 1.30.6 builds password-reset links from the HTTP Host header, so an attacker can make a reset link point to their own server. A mail scanner that opens the poisoned link leaks the live recovery token, which lets the attacker set a new password and then run commands as the hosting account through the File Manager and Crontab modules.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["control-web-panel","hosting","linux","other","self-hosted"],"not_affected_if":["panel-not-internet-exposed","webpanel-1.30.6-or-later"],"how_to_check":"- Check the installed CWP version in the admin panel or the webpanel_version value; versions below `1.30.6` are in the stated range\n- Confirm whether the panel is reachable from the internet, since the /v1/lostpass/ route is unauthenticated\n- Review web server logs for requests to /v1/lostpass/ with unusual Host headers","fix":"- Control Web Panel: upgrade to `webpanel_version` `1.30.6` or later","status":"open","published_at":"2026-11-13T22:17:22+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","triaged_at":"2026-11-13T22:34:17+00:00","updated_at":"2026-11-13T22:34:17+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T22:34:17Z","model":"claude-haiku-5-5","output":{"fix":"- Control Web Panel: upgrade to `webpanel_version` `1.30.6` or later","reach":"internet","title":"Control Web Panel: password reset host header flaw enables account takeover","impact":"high","summary":"Control Web Panel (CWP) before webpanel_version 1.30.6 builds password-reset links from the HTTP Host header, so an attacker can make a reset link point to their own server. A mail scanner that opens the poisoned link leaks the live recovery token, which lets the attacker set a new password and then run commands as the hosting account through the File Manager and Crontab modules.","audience":"businesses","category":"other","nicknames":[],"who_cares":["control-web-panel","self-hosted","hosting","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker takes over hosting account and runs commands","analyst_note":"Check the vulncheck advisory for the exact CWP version range and any setting that disables the reset route, and whether a patch exists beyond 1.30.6.","how_to_check":"- Check the installed CWP version in the admin panel or the webpanel_version value; versions below `1.30.6` are in the stated range\n- Confirm whether the panel is reachable from the internet, since the /v1/lostpass/ route is unauthenticated\n- Review web server logs for requests to /v1/lostpass/ with unusual Host headers","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["webpanel-1.30.6-or-later","panel-not-internet-exposed"],"who_is_affected":"Any server running Control Web Panel before `webpanel_version` `1.30.6` with its password-recovery route reachable from the internet is exposed. Servers that are not running CWP, or that keep the panel off the public internet, face much less risk.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000797,"input_tokens":4678,"output_tokens":658,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124020':14A,17A '-2026':13A,16A '/login/index.php':159C '/v1/lostpass':129C '1.30.6':35B,102C 'abus':169C 'acc':160C 'account':10A,87B,184C 'achiev':177C 'allow':110C 'attack':48B,75B,112C,135C 'autom':139C 'build':36B 'command':83B,178C 'contain':103C 'control':1A,19B,28B,95C 'control-web-panel':18B 'crontab':93B,174C 'cve':12A,15A 'cwp':31B,98C 'enabl':9A 'execut':179C 'exfiltr':151C 'file':90B,171C 'flaw':8A 'generat':133C 'header':7A,45B,106C,126C 'host':6A,22B,27B,44B,86B,105C,125C,183C 'http':43B,124C 'inject':107C,122C 'leak':67B 'let':73B 'link':40B,53B,66B,149C 'linux':23B 'live':69B,153C 'lure':137C 'mail':60B,141C 'mail-secur':140C 'make':50B 'manag':91B,172C 'manipul':114C 'modul':94B,175C 'new':78B,165C 'newpass':161C 'open':63B 'panel':3A,21B,30B,97C 'password':4A,38B,79B,117C,166C 'password-recoveri':116C 'password-reset':37B 'point':54B 'poison':65B,147C 'process':134C 'recoveri':70B,118C,154C 'replay':156C 'reset':5A,39B,52B,119C,148C 'rout':130C 'run':82B 'scanner':61B,143C 'secur':142C 'self':26B 'self-host':25B 'server':58B 'set':76B,163C 'subsequ':168C 'takeov':11A 'target':182C 'token':71B,132C,155C 'unauthent':111C 'url':120C 'version':34B,101C 'visit':145C 'vulner':108C 'web':2A,20B,29B,96C 'webpanel':33B,100C","nicknames":[],"mitigations":[],"who_affected":"Any server running Control Web Panel before `webpanel_version` `1.30.6` with its password-recovery route reachable from the internet is exposed. Servers that are not running CWP, or that keep the panel off the public internet, face much less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["controlwebpanel","critical","hosting","linux","other","selfhosted"],"campaign_type":null,"search_a":"'-124020':14A,17A '-2026':13A,16A 'account':10A 'control':1A 'cve':12A,15A 'enabl':9A 'flaw':8A 'header':7A 'host':6A 'panel':3A 'password':4A 'reset':5A 'takeov':11A 'web':2A","search_b":"'1.30.6':35B 'account':87B 'attack':48B,75B 'build':36B 'command':83B 'control':19B,28B 'control-web-panel':18B 'crontab':93B 'cwp':31B 'file':90B 'header':45B 'host':22B,27B,44B,86B 'http':43B 'leak':67B 'let':73B 'link':40B,53B,66B 'linux':23B 'live':69B 'mail':60B 'make':50B 'manag':91B 'modul':94B 'new':78B 'open':63B 'panel':21B,30B 'password':38B,79B 'password-reset':37B 'point':54B 'poison':65B 'recoveri':70B 'reset':39B,52B 'run':82B 'scanner':61B 'self':26B 'self-host':25B 'server':58B 'set':76B 'token':71B 'version':34B 'web':20B,29B 'webpanel':33B","search_c":"'/login/index.php':159C '/v1/lostpass':129C '1.30.6':102C 'abus':169C 'acc':160C 'account':184C 'achiev':177C 'allow':110C 'attack':112C,135C 'autom':139C 'command':178C 'contain':103C 'control':95C 'crontab':174C 'cwp':98C 'execut':179C 'exfiltr':151C 'file':171C 'generat':133C 'header':106C,126C 'host':105C,125C,183C 'http':124C 'inject':107C,122C 'link':149C 'live':153C 'lure':137C 'mail':141C 'mail-secur':140C 'manag':172C 'manipul':114C 'modul':175C 'new':165C 'newpass':161C 'panel':97C 'password':117C,166C 'password-recoveri':116C 'poison':147C 'process':134C 'recoveri':118C,154C 'replay':156C 'reset':119C,148C 'rout':130C 'scanner':143C 'secur':142C 'set':163C 'subsequ':168C 'target':182C 'token':132C,155C 'unauthent':111C 'url':120C 'version':101C 'visit':145C 'vulner':108C 'web':96C 'webpanel':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124020","severity":null,"published_at":"2026-11-13T22:17:22+00:00","modified_at":"2026-11-13T22:17:22+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","fetched_at":"2026-11-13T22:33:34+00:00","note":null}],"documents":[{"id":150660,"url":"https://www.vulncheck.com/advisories/control-web-panel-host-header-password-reset-poisoning","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}