Critical vulnerabilities
2 critical vulnerabilities in Control Web Panel
2 vulnerabilities rated critical (CVSS 9.0 or higher) found on 13 November 2026: Broken access control in servers and applications.
- 2 critical
Broken access control in Control Web Panel · Servers and applications
CVE-2026-124021
Control Web Panel < 1.30.6 Authorization Bypass via oauth_authorization_codes
- Severity
- Critical 9.2
- Published
- 13 Nov 2026
- Fixed in
- 1.30.6
- Attack
- Over the network · Only under certain conditions · No login needed · No user action needed
- Attacker can
- Read data · Change data · Take it down
Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, contact emails, and password hashes.
| Software | Affected versions |
|---|---|
| Control Web PanelServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-124021
Control Web Panel · Servers and applications
CVE-2026-124020
Control Web Panel < 1.30.6 Host Header Password Reset Poisoning
- Severity
- Critical 9.2
- Published
- 13 Nov 2026
- Fixed in
- 1.30.6
- Weakness
- Weak password recovery (CWE-640)
- Attack
- Over the network · Only under certain conditions · No login needed · No user action needed
- Attacker can
- Read data · Change data · Take it down
Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account.
| Software | Affected versions |
|---|---|
| Control Web PanelServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-124020
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.