{
  "id": "cwp-user-panel-api",
  "url": "https://ohshit.app/incidents/cwp-user-panel-api/",
  "title": "Nine Control Web Panel flaws cross user-panel and root API boundaries",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-02",
  "date_is_approximate": false,
  "updated": "2026-11-03",
  "tags": [
    "hosting",
    "auth bypass",
    "RCE"
  ],
  "ecosystems": [
    "cwp"
  ],
  "summary": "Nine CWP disclosures cover an authentication bypass, file inclusion/write, command injection and SQL injection. Several API bugs require access to a loopback service. Update to the current vendor release and verify all applicable fixes; 1.12 alone does not cover the batch.",
  "splash": "Older CWP user panels; several root API bugs additionally require access to the loopback API",
  "wipe": "Update CWP through its supported channel; verify the nine fixes and restrict user-panel and API reachability",
  "in_the_wild": "unknown",
  "source_exception": null,
  "cves": [
    {
      "id": "CVE-2026-73695",
      "score": 8.7,
      "name": "Local PHP file inclusion",
      "description": "Before 1.16, the module parameter in services/users/index.php can escape its include directory; the CNA rates this low-privileged access."
    },
    {
      "id": "CVE-2026-73696",
      "score": 9.3,
      "name": "Execution after login redirect",
      "description": "Before 1.12, a login redirect does not stop PHP execution, letting unauthenticated requests reach protected user-panel functions."
    },
    {
      "id": "CVE-2026-73697",
      "score": 8.7,
      "name": "phpini_editor file write and commands",
      "description": "Before 1.16, module access permits unconstrained file writes through acc=update and shell injection through acc=addlabelphpiniadv; CNA rates privileges required as low."
    },
    {
      "id": "CVE-2026-77876",
      "score": 9.3,
      "name": "protected_directory command injection",
      "description": "Before 1.16, the file POST parameter in acc=deletedp reaches a shell command in the user-panel context."
    },
    {
      "id": "CVE-2026-77877",
      "score": 8.6,
      "name": "Missing loopback API authentication",
      "description": "Before 1.30, callers that can reach the loopback API can invoke root-privileged routes without an access token."
    },
    {
      "id": "CVE-2026-77878",
      "score": 8.6,
      "name": "Database-restore API command injection",
      "description": "Before 1.30, a reachable /v1/restoredatabase/ route passes a POST file path into a root shell command."
    },
    {
      "id": "CVE-2026-77879",
      "score": 8.5,
      "name": "API authentication SQL injection",
      "description": "Before 1.16, authorization_code and client_id are interpolated into a root MySQL query in access_token(); loopback API access is required."
    },
    {
      "id": "CVE-2026-77880",
      "score": 8.6,
      "name": "Password-route root command injection",
      "description": "Before 1.16, the loopback /newpass/ route uses an unescaped POST user value in a root shell command."
    },
    {
      "id": "CVE-2026-77881",
      "score": 6.9,
      "name": "Loopback blind SQL injection",
      "description": "Before 1.30, the user parameter in /user_panel_dashboard/, later /valid_token/, enters a root database query; loopback API access is required."
    }
  ],
  "fixed": [
    {
      "product": "Control Web Panel current vendor release",
      "version": "1.30.1",
      "status": "Vendor November 3 LTS security update; CNA affected bounds are 1.12, 1.16 or 1.30. Verify each applicable fix"
    }
  ],
  "checklist": [
    {
      "title": "Upgrade the actual CWP installation",
      "hint": "Use Settings > CWP Settings > CWP updates and the supported update channel. The vendor’s Update page shows installed/latest versions and an update log. Choose the now-published 1.30.1 LTS or an applicable later release. Confirm the version and completed update afterward; ask support to verify coverage of all nine CVEs. Do not stop at the 1.12 auth-bypass boundary."
    },
    {
      "title": "Restrict user-panel and internal API access",
      "hint": "As a precaution, limit panel access to trusted management paths. Check that loopback API services are not exposed through public binds, proxies or forwarding. Local callers or server-side request paths may still reach loopback; public-panel filtering alone does not fix API bugs."
    },
    {
      "title": "Preserve and review panel activity",
      "hint": "As a precaution, retain panel/web access logs and compare requests involving module, phpini_editor, protected_directory and the API routes listed below with approved activity. Review unexpected file, account, configuration or database changes. Route names are vulnerable surfaces, not proof of exploitation; the advisories publish no attack IoCs."
    },
    {
      "title": "Escalate unexplained privileged changes",
      "hint": "Preserve evidence and involve your hosting provider or incident responder if unapproved commands or root-level changes are found. Patching does not undo an existing compromise. The disclosures do not supply a forensic cleanup procedure."
    },
    {
      "title": "Verify API and mail behavior after updating",
      "hint": "Version 1.30.1 hardens API keys and one-time login links. Check whether /usr/local/cwp/.conf/api_strict_guard_off disables the strict API guard and confirm integrations still require authorization; do not restore functionality by disabling protection. If mail trust changes from old defaults to 127.0.0.0/8, configure SMTP authentication on other private-network machines. Test legitimate integrations and mail delivery."
    }
  ],
  "sources": [
    {
      "name": "Control Web Panel changelog",
      "url": "https://control-webpanel.com/changelog",
      "says": "Vendor release dates, current update workflow and security changes; no per-CVE patch mapping.",
      "primary": true
    },
    {
      "name": "VulnCheck CVE-2026-73695",
      "url": "https://cveawg.mitre.org/api/cve/CVE-2026-73695",
      "says": "November 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.",
      "primary": true
    },
    {
      "name": "VulnCheck CVE-2026-73696",
      "url": "https://cveawg.mitre.org/api/cve/CVE-2026-73696",
      "says": "November 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.",
      "primary": true
    },
    {
      "name": "VulnCheck CVE-2026-73697",
      "url": "https://cveawg.mitre.org/api/cve/CVE-2026-73697",
      "says": "November 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.",
      "primary": true
    },
    {
      "name": "VulnCheck CVE-2026-77876",
      "url": "https://cveawg.mitre.org/api/cve/CVE-2026-77876",
      "says": "November 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.",
      "primary": true
    },
    {
      "name": "VulnCheck CVE-2026-77877",
      "url": "https://cveawg.mitre.org/api/cve/CVE-2026-77877",
      "says": "November 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.",
      "primary": true
    },
    {
      "name": "VulnCheck CVE-2026-77878",
      "url": "https://cveawg.mitre.org/api/cve/CVE-2026-77878",
      "says": "November 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.",
      "primary": true
    },
    {
      "name": "VulnCheck CVE-2026-77879",
      "url": "https://cveawg.mitre.org/api/cve/CVE-2026-77879",
      "says": "November 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.",
      "primary": true
    },
    {
      "name": "VulnCheck CVE-2026-77880",
      "url": "https://cveawg.mitre.org/api/cve/CVE-2026-77880",
      "says": "November 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.",
      "primary": true
    },
    {
      "name": "VulnCheck CVE-2026-77881",
      "url": "https://cveawg.mitre.org/api/cve/CVE-2026-77881",
      "says": "November 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "The disclosures do not establish exploitation in the wild.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Sep 8, 2026",
      "title": "Vendor releases CWP 1.12",
      "body": "The changelog says security improvements without mapping these CVEs."
    },
    {
      "date": "Oct 31, 2026",
      "title": "Vendor releases CWP 1.30",
      "body": "The current changelog includes further user-panel and internal API hardening."
    },
    {
      "date": "Nov 2, 2026",
      "title": "VulnCheck publishes nine related CVE records",
      "body": "Detailed public disclosure date, distinct from the earlier release dates."
    },
    {
      "date": "Nov 3, 2026",
      "title": "Vendor releases 1.30.1 LTS and recommends it for every server",
      "body": "Further hardens API-key checks, internal calls, one-time login links and update downloads; default mail trust networks also narrow."
    }
  ],
  "body_markdown": "The batch affects a hosting control panel, so it merits L3 even without confirmed attacks. All scores shown are VulnCheck’s CVSS 4.0 scores. No deployment count or successful attack is established by these records.\n\nThe user-panel authentication flaw is separate from the file and command-execution bugs. CVE-2026-73695 and CVE-2026-73697 are scored as requiring low privileges. The records do not demonstrate that every installation permits a complete unauthenticated chain to root; do not assume such a chain from the scores alone.\n\nThe remaining API issues are an additional boundary: CVE-2026-77877 through CVE-2026-77881 concern a loopback service. Their vectors are local, even where the description calls the resulting execution remote. An attacker must be able to reach that service. Missing-token routes include /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/ and /user_panel_dashboard/. These are not published attack indicators.\n\nCNA affected bounds differ: 1.12 for the redirect flaw; 1.16 for file inclusion, phpini_editor, protected_directory, access_token() and /newpass/; 1.30 for missing API authentication, database restore and blind SQL injection. The vendor changelog lists 1.30 as released October 31 but does not map every CVE to its fix, and does not provide a 1.16 entry. Use the current supported vendor update and confirm coverage rather than treating 1.12 as sufficient. The two-component version labels are the vendor/CNA labels; no version checker is offered.\n\n**November 3 update:** On rereading, the vendor changelog added 1.30.1 LTS, a security and stability release recommended for every server. It further requires API keys for each API v1 call on port 2304, limits internal migration routes to the local server, and hardens account actions, one-time login links and HTTPS update downloads. Check that an existing /usr/local/cwp/.conf/api_strict_guard_off switch is not disabling the strict guard. The changelog still does not map all nine CVEs individually, so this is the current vendor-recommended update rather than an inferred first fix for every flaw. Test integrations and mail after updating: servers still on the old default mail trust list are changed to 127.0.0.0/8, and applications on other private-network machines must use SMTP authentication."
}