Live › vulnerability › CVE-2026-73696
Control Web Panel (CWP) keeps running PHP after sending a login redirect in its user panel, so the module dispatcher runs without authentication. An attacker with a valid hosting username can bypass login and chain this to root access on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Hosting servers running Control Web Panel before webpanel_version 1.12 that expose the user panel. The sources describe the flaw as reachable with any valid hosting username, so shared hosting accounts are the main concern. unknown whether servers with the panel restricted to a private network are exposed.
No product ranges from the sources yet.
1.12 are listed as affected.1.12 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() which emits a redirect header without exit(), allowing PHP execution to continue and the module dispatcher include to run without authentication. Attackers with nothing more than a valid hosting username can bypass authentication to reach user-panel module code paths, enabling a pre-authentication chain to root access.
This page as .md · .json · in your agent: get_signal("CVE-2026-73696")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.