CVE-2026-124021 · Other
NO FIX YET · SEE WHAT TO DO
Control Web Panel (CWP) before 1.30.6 has an authorization bypass in its remote API validation: a password-recovery token and a predictable legacy signature are enough to pass. An attacker can add cron commands through the cronjobsusers endpoint to run code as the hosting account, and can read account lists with usernames, emails and password hashes.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers running Control Web Panel before webpanel_version 1.30.6 that expose its remote API are exposed. Systems where the remote API is not reachable from the network, or that run a patched version, are not affected. The sources do not say which default configuration exposes the API.
Not affected if api-not-exposed, patched-version
Who cares control-web-panel, linux, self-hosted, shared-hosting
1.30.6; the sources say versions before webpanel_version 1.30.6 are affectedwebpanel_version 1.30.6 or laterControl Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, contact emails, and password hashes.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.