Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Control Web Panel | Control Web Panel | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 13 Nov 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, contact emails, and password hashes. | |
| Title | Control Web Panel < 1.30.6 Authorization Bypass via oauth_authorization_codes | |
| Weaknesses | CWE-863 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-13T21:43:13.762Z
Reserved: 2026-11-06T18:38:38.544Z
Link: CVE-2026-124021
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-13T22:17:22.217
Modified: 2026-11-13T22:17:22.217
Link: CVE-2026-124021
Redhat
No data.
OpenCVE Enrichment
No data.