CVE-2026-77877

HIGH 8.4

Control Web Panel (CWP) < 1.30 Unauthenticated Loopback API Root Access

CVSS Score

8.4

EPSS Score

0.0%

EPSS Percentile

0th

Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.

CWE	CWE-306
Vendor	control web panel
Product	control web panel
Published	Nov 2, 2026
Last Updated	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for control web panel control web panel

Be the first to know when new high vulnerabilities affecting control web panel control web panel are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Control Web Panel / Control Web Panel

0 < 1.30

References

NVD ↗ CVE.org ↗ EPSS Data ↗

control-webpanel.com: https://control-webpanel.com/changelog vulncheck.com: https://www.vulncheck.com/advisories/control-web-panel-cwp-unauthenticated-loopback-api-root-access

Credits

Valentin Lobstein (Chocapikk)