{"id":"CVE-2026-73696","kind":"vulnerability","aliases":["CVE-2026-73696"],"related":[],"title":"Control Web Panel: missing exit after redirect lets unauthenticated users reach admin code","description":"Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() which emits a redirect header without exit(), allowing PHP execution to continue and the module dispatcher include to run without authentication. Attackers with nothing more than a valid hosting username can bypass authentication to reach user-panel module code paths, enabling a pre-authentication chain to root access.","summary":"Control Web Panel (CWP) keeps running PHP after sending a login redirect in its user panel, so the module dispatcher runs without authentication. An attacker with a valid hosting username can bypass login and chain this to root access on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["control-web-panel","cwp","php","runtime","self-hosted","shared-hosting"],"not_affected_if":["webpanel-version-1.12-or-later"],"how_to_check":"- Check the installed CWP version in the admin panel or the webpanel version file; versions below `1.12` are listed as affected.\n- Confirm whether the user panel is reachable from the internet on your servers.","fix":"- Upgrade Control Web Panel to `1.12` or later.","status":"open","published_at":"2026-11-02T15:17:37+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","triaged_at":"2026-11-02T15:25:39+00:00","updated_at":"2026-11-02T15:25:39+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-02T15:25:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Control Web Panel to `1.12` or later.","reach":"internet","title":"Control Web Panel: missing exit after redirect lets unauthenticated users reach admin code","impact":"high","summary":"Control Web Panel (CWP) keeps running PHP after sending a login redirect in its user panel, so the module dispatcher runs without authentication. An attacker with a valid hosting username can bypass login and chain this to root access on the server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["control-web-panel","cwp","php","self-hosted","shared-hosting"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker gains root access on the hosting server after login bypass","analyst_note":"Confirm the affected version range and whether the user panel is internet-facing by default, using the NVD entry and the VulnCheck advisory.","how_to_check":"- Check the installed CWP version in the admin panel or the webpanel version file; versions below `1.12` are listed as affected.\n- Confirm whether the user panel is reachable from the internet on your servers.","plain_action":"","needs_analyst":true,"not_affected_if":["webpanel-version-1.12-or-later"],"who_is_affected":"Hosting servers running Control Web Panel before webpanel_version 1.12 that expose the user panel. The sources describe the flaw as reachable with any valid hosting username, so shared hosting accounts are the main concern. unknown whether servers with the panel restricted to a private network are exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00071,"input_tokens":4228,"output_tokens":575,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-73696':16A,19A '1.12':82C 'access':71B,150C 'admin':12A 'allow':108C 'attack':57B,122C 'authent':55B,93C,121C,133C,146C 'bypass':64B,132C 'call':99C 'chain':67B,147C 'code':13A,140C 'contain':83C 'continu':112C 'control':1A,21B,33B,75C 'control-web-panel':20B 'cve':14A,17A 'cwp':24B,36B,78C 'cwpuserindex':96C 'dispatch':52B,116C 'emit':102C 'enabl':142C 'execut':85C,110C 'exit':5A,107C 'flow':94C 'header':105C 'host':29B,32B,61B,129C 'includ':117C 'keep':37B 'let':8A 'login':43B,65B 'miss':4A 'modul':51B,115C,139C 'noth':124C 'panel':3A,23B,35B,48B,77C,92C,138C 'path':141C 'php':25B,39B,109C 'pre':145C 'pre-authent':144C 'reach':11A,135C 'redirect':7A,44B,87C,104C 'root':70B,149C 'run':38B,53B,119C 'runtim':26B 'self':28B 'self-host':27B 'send':41B 'server':74B 'share':31B 'shared-host':30B 'tologinwithintendeduri':100C 'unauthent':9A 'unauthenticatedflow':98C 'user':10A,47B,91C,137C 'user-panel':136C 'usernam':62B,130C 'valid':60B,128C 'version':81C 'vulner':88C 'web':2A,22B,34B,76C 'webpanel':80C 'without':54B,106C,120C","nicknames":[],"mitigations":[],"who_affected":"Hosting servers running Control Web Panel before webpanel_version 1.12 that expose the user panel. The sources describe the flaw as reachable with any valid hosting username, so shared hosting accounts are the main concern. unknown whether servers with the panel restricted to a private network are exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["controlwebpanel","critical","cwp","php","runtime","selfhosted","sharedhosting"],"first_public_at":"2026-11-02T15:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73696","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73696","severity":null,"published_at":"2026-11-02T15:17:37+00:00","modified_at":"2026-11-02T15:17:37+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","fetched_at":"2026-11-02T15:24:04+00:00","note":null}],"documents":[{"id":52543,"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-authentication-bypass-via-execution-after-redirect","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}