{"id":"CVE-2026-124021","kind":"vulnerability","aliases":["CVE-2026-124021"],"related":[],"title":"Control Web Panel: authorization bypass gives attackers command execution on hosting accounts","description":"Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, contact emails, and password hashes.","summary":"Control Web Panel (CWP) before 1.30.6 has an authorization bypass in its remote API validation: a password-recovery token and a predictable legacy signature are enough to pass. An attacker can add cron commands through the cronjobsusers endpoint to run code as the hosting account, and can read account lists with usernames, emails and password hashes.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["control-web-panel","linux","other","self-hosted","shared-hosting"],"not_affected_if":["api-not-exposed","patched-version"],"how_to_check":"- Check the installed CWP version against `1.30.6`; the sources say versions before `webpanel_version 1.30.6` are affected\n- Look for unexpected entries in cron jobs for hosting accounts","fix":"- Upgrade Control Web Panel to `webpanel_version 1.30.6` or later","status":"open","published_at":"2026-11-13T22:17:22+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","triaged_at":"2026-11-13T22:34:17+00:00","updated_at":"2026-11-13T22:34:17+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T22:34:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Control Web Panel to `webpanel_version 1.30.6` or later","reach":"network","title":"Control Web Panel: authorization bypass gives attackers command execution on hosting accounts","impact":"high","summary":"Control Web Panel (CWP) before 1.30.6 has an authorization bypass in its remote API validation: a password-recovery token and a predictable legacy signature are enough to pass. An attacker can add cron commands through the cronjobsusers endpoint to run code as the hosting account, and can read account lists with usernames, emails and password hashes.","audience":"businesses","category":"other","nicknames":[],"who_cares":["control-web-panel","self-hosted","shared-hosting","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as hosting account; account data and password hashes leak","analyst_note":"Confirm whether the remote API is enabled by default and which recovery-token setup is needed; check the vulncheck advisory for exploitation details.","how_to_check":"- Check the installed CWP version against `1.30.6`; the sources say versions before `webpanel_version 1.30.6` are affected\n- Look for unexpected entries in cron jobs for hosting accounts\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["patched-version","api-not-exposed"],"who_is_affected":"Servers running Control Web Panel before webpanel_version 1.30.6 that expose its remote API are exposed. Systems where the remote API is not reachable from the network, or that run a patched version, are not affected. The sources do not say which default configuration exposes the API.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000773,"input_tokens":4677,"output_tokens":610,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124021':15A,18A '-2026':14A,17A '/cronjobsusers':141C '1.30.6':36B,95C 'abus':160C 'access':165C 'account':12A,76B,80B,156C,168C,172C 'account-detail':171C 'account-list':167C 'achiev':149C 'add':63B,144C 'affect':154C 'allow':108C 'also':159C 'api':44B,126C,131C 'api/v1/index.php':106C 'arbitrari':145C 'attack':7A,61B,109C,133C 'author':4A,39B,98C,127C 'bypass':5A,40B,99C 'code':72B 'command':8A,65B,147C,150C 'contact':177C 'contain':96C 'control':1A,20B,31B,88C 'control-web-panel':19B 'cron':64B,146C 'cronjobsus':68B 'cve':13A,16A 'cwp':34B,91C 'detail':173C 'email':84B,178C 'endpoint':69B,142C 'enough':57B 'execut':9A,151C 'exploit':135C 'expos':175C 'flaw':137C 'function':104C 'give':6A 'global':166C 'hash':87B,181C 'hold':110C 'host':11A,27B,30B,75B,155C 'key':132C 'legaci':54B,119C 'linux':23B 'list':81B,169C 'obtain':122C 'panel':3A,22B,33B,90C 'pass':59B 'password':48B,86B,113C,180C 'password-recoveri':47B,112C 'post':140C 'predict':53B,118C 'proper':130C 'read':79B 'recoveri':49B,114C 'remot':43B,125C 'remote-api':124C 'rout':174C 'run':71B 'self':26B 'self-host':25B 'share':29B 'shared-host':28B 'signatur':55B,120C 'token':50B,115C,163C 'usernam':83B,176C 'valid':45B,103C,123C 'version':94C 'via':138C 'vulner':100C 'web':2A,21B,32B,89C 'webpanel':93C 'without':128C","nicknames":[],"mitigations":[],"who_affected":"Servers running Control Web Panel before webpanel_version 1.30.6 that expose its remote API are exposed. Systems where the remote API is not reachable from the network, or that run a patched version, are not affected. The sources do not say which default configuration exposes the API.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["controlwebpanel","critical","linux","other","selfhosted","sharedhosting"],"campaign_type":null,"search_a":"'-124021':15A,18A '-2026':14A,17A 'account':12A 'attack':7A 'author':4A 'bypass':5A 'command':8A 'control':1A 'cve':13A,16A 'execut':9A 'give':6A 'host':11A 'panel':3A 'web':2A","search_b":"'1.30.6':36B 'account':76B,80B 'add':63B 'api':44B 'attack':61B 'author':39B 'bypass':40B 'code':72B 'command':65B 'control':20B,31B 'control-web-panel':19B 'cron':64B 'cronjobsus':68B 'cwp':34B 'email':84B 'endpoint':69B 'enough':57B 'hash':87B 'host':27B,30B,75B 'legaci':54B 'linux':23B 'list':81B 'panel':22B,33B 'pass':59B 'password':48B,86B 'password-recoveri':47B 'predict':53B 'read':79B 'recoveri':49B 'remot':43B 'run':71B 'self':26B 'self-host':25B 'share':29B 'shared-host':28B 'signatur':55B 'token':50B 'usernam':83B 'valid':45B 'web':21B,32B","search_c":"'/cronjobsusers':141C '1.30.6':95C 'abus':160C 'access':165C 'account':156C,168C,172C 'account-detail':171C 'account-list':167C 'achiev':149C 'add':144C 'affect':154C 'allow':108C 'also':159C 'api':126C,131C 'api/v1/index.php':106C 'arbitrari':145C 'attack':109C,133C 'author':98C,127C 'bypass':99C 'command':147C,150C 'contact':177C 'contain':96C 'control':88C 'cron':146C 'cwp':91C 'detail':173C 'email':178C 'endpoint':142C 'execut':151C 'exploit':135C 'expos':175C 'flaw':137C 'function':104C 'global':166C 'hash':181C 'hold':110C 'host':155C 'key':132C 'legaci':119C 'list':169C 'obtain':122C 'panel':90C 'password':113C,180C 'password-recoveri':112C 'post':140C 'predict':118C 'proper':130C 'recoveri':114C 'remot':125C 'remote-api':124C 'rout':174C 'signatur':120C 'token':115C,163C 'usernam':176C 'valid':103C,123C 'version':94C 'via':138C 'vulner':100C 'web':89C 'webpanel':93C 'without':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124021","severity":null,"published_at":"2026-11-13T22:17:22+00:00","modified_at":"2026-11-13T22:17:22+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","fetched_at":"2026-11-13T22:33:34+00:00","note":null}],"documents":[{"id":150661,"url":"https://www.vulncheck.com/advisories/control-web-panel-authorization-bypass-via-oauth-authorization-codes","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}