Live › vulnerability › CVE-2026-77877
Control Web Panel (CWP) before version 1.30 exposes root-privileged API routes on its loopback service without requiring an access token. An attacker who can reach that loopback API can restore databases, manage users and perform other root-level actions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Servers running Control Web Panel before 1.30 are exposed. The risk is highest where local users, other services or containers can reach the loopback API port, since the flaw is reached from the local side. Hosts running a patched version or with no CWP installed can skip it.
No product ranges from the sources yet.
webpanel_version in the panel configuration; anything below 1.30 is affected.1.30 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-77877")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.