---
id: "CVE-2026-124021"
page: "https://infrastack.ai/live/CVE-2026-124021"
kind: "vulnerability"
aliases: ["CVE-2026-124021"]
title: "Control Web Panel: authorization bypass gives attackers command execution on hosting accounts"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["control-web-panel", "linux", "other", "self-hosted", "shared-hosting"]
not_affected_if: ["api-not-exposed", "patched-version"]
published_at: "2026-11-13T22:17:22+00:00"
first_seen_at: "2026-11-13T22:33:34+00:00"
updated_at: "2026-11-13T22:34:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124021", "first_seen_at": "2026-11-13T22:33:34+00:00"}]
exploit_sources: []
---

# Control Web Panel: authorization bypass gives attackers command execution on hosting accounts

Link for people: https://infrastack.ai/live/CVE-2026-124021 (this .md is for agents)

Control Web Panel (CWP) before 1.30.6 has an authorization bypass in its remote API validation: a password-recovery token and a predictable legacy signature are enough to pass. An attacker can add cron commands through the cronjobsusers endpoint to run code as the hosting account, and can read account lists with usernames, emails and password hashes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CWP version against `1.30.6`; the sources say versions before `webpanel_version 1.30.6` are affected
- Look for unexpected entries in cron jobs for hosting accounts

## Fix

- Upgrade Control Web Panel to `webpanel_version 1.30.6` or later

## Timeline

- 2026-11-13T22:33:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124021

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/control-web-panel-authorization-bypass-via-oauth-authorization-codes

## From the sources

Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, contact emails, and password hashes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_