CVE-2026-124021

HIGH 8.1

Control Web Panel < 1.30.6 Authorization Bypass via oauth_authorization_codes

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, contact emails, and password hashes.

CWE	CWE-863
Vendor	control web panel
Product	control web panel
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for control web panel control web panel

Be the first to know when new high vulnerabilities affecting control web panel control web panel are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Control Web Panel / Control Web Panel

0 < 1.30.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

control-webpanel.com: https://control-webpanel.com/changelog vulncheck.com: https://www.vulncheck.com/advisories/control-web-panel-authorization-bypass-via-oauth-authorization-codes

Credits

Valentin Lobstein (Chocapikk)