{"id":"CVE-2026-77877","kind":"vulnerability","aliases":["CVE-2026-77877"],"related":[],"title":"Control Web Panel: loopback API skips authentication, exposing root-level routes","description":"Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.","summary":"Control Web Panel (CWP) before version 1.30 exposes root-privileged API routes on its loopback service without requiring an access token. An attacker who can reach that loopback API can restore databases, manage users and perform other root-level actions.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["control-web-panel","linux-servers","runtime","self-hosted"],"not_affected_if":["not-installed","patched-1.30-or-later"],"how_to_check":"- Check the installed CWP version against `webpanel_version` in the panel configuration; anything below `1.30` is affected.\n- Confirm whether the loopback API service is reachable from untrusted users or processes on the host.","fix":"- Upgrade Control Web Panel to `1.30` or later.","status":"open","published_at":"2026-11-02T16:17:43+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","triaged_at":"2026-11-02T16:26:22+00:00","updated_at":"2026-11-02T16:26:22+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-02T16:26:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Control Web Panel to `1.30` or later.","reach":"local","title":"Control Web Panel: loopback API skips authentication, exposing root-level routes","impact":"high","summary":"Control Web Panel (CWP) before version 1.30 exposes root-privileged API routes on its loopback service without requiring an access token. An attacker who can reach that loopback API can restore databases, manage users and perform other root-level actions.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["control-web-panel","self-hosted","linux-servers"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs root-privileged panel actions without any credentials","analyst_note":"Confirm whether the loopback API is reachable remotely through any proxy or port forward, and check the vendor advisory at www.vulncheck.com for the exact fix details.","how_to_check":"- Check the installed CWP version against `webpanel_version` in the panel configuration; anything below `1.30` is affected.\n- Confirm whether the loopback API service is reachable from untrusted users or processes on the host.","plain_action":"","needs_analyst":true,"not_affected_if":["patched-1.30-or-later","not-installed"],"who_is_affected":"Servers running Control Web Panel before 1.30 are exposed. The risk is highest where local users, other services or containers can reach the loopback API port, since the flaw is reached from the local side. Hosts running a patched version or with no CWP installed can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4202,"output_tokens":567,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-77877':15A,18A '/generaluser':114C '/last_access':115C '/user_panel_dashboard':119C '/v1/restoredatabase':113C '/valid_token':117C '/valid_user':116C '1.30':36B,79C 'abl':88C 'access':50B,105C,109C 'action':71B,123C 'allow':86C 'api':5A,41B,59B,93C,100C 'attack':53B,87C,107C 'authent':7A,83C 'contain':80C 'control':1A,20B,30B,72C 'control-web-panel':19B 'cve':13A,16A 'cwp':33B,75C 'databas':62B 'endpoint':110C 'expos':8A,37B 'host':29B 'invok':96C 'level':11A,70B 'linux':24B 'linux-serv':23B 'loopback':4A,45B,58B,92C 'manag':63B 'miss':82C 'panel':3A,22B,32B,74C 'perform':66B,121C 'present':103C 'privileg':40B,99C,126C 'reach':56B,90C 'requir':48B 'restor':61B 'root':10A,39B,69B,98C,125C 'root-level':9A,68B 'root-privileg':38B,97C 'rout':12A,42B,101C 'runtim':26B 'self':28B 'self-host':27B 'server':25B 'servic':46B,94C 'skip':6A 'token':51B,106C 'unauthor':122C 'user':64B 'version':35B,78C 'vulner':84C 'web':2A,21B,31B,73C 'webpanel':77C 'without':47B,102C","nicknames":[],"mitigations":[],"who_affected":"Servers running Control Web Panel before 1.30 are exposed. The risk is highest where local users, other services or containers can reach the loopback API port, since the flaw is reached from the local side. Hosts running a patched version or with no CWP installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["controlwebpanel","high","linuxservers","runtime","selfhosted"],"first_public_at":"2026-11-02T16:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77877","severity":null,"published_at":"2026-11-02T16:17:43+00:00","modified_at":"2026-11-02T16:17:43+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","fetched_at":"2026-11-02T16:24:04+00:00","note":null}],"documents":[{"id":52772,"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-unauthenticated-loopback-api-root-access","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}