L3 · Shartedhosting · auth bypass · RCEcwp-user-panel-api

Nine Control Web Panel flaws cross user-panel and root API boundaries

Nine CWP disclosures cover an authentication bypass, file inclusion/write, command injection and SQL injection. Several API bugs require access to a loopback service. Update to the current vendor release and verify all applicable fixes; 1.12 alone does not cover the batch.

Disclosed: Nov 2, 2026; Updated Nov 3, 2026
Severity: CVSS 9.3 × 2; 9 CVEs tracked here
Splash zone: Older CWP user panels; several root API bugs additionally require access to the loopback API; cwp
In the wild: Unknown; The disclosures do not establish exploitation in the wild.

What happened

The batch affects a hosting control panel, so it merits L3 even without confirmed attacks. All scores shown are VulnCheck’s CVSS 4.0 scores. No deployment count or successful attack is established by these records.

The user-panel authentication flaw is separate from the file and command-execution bugs. CVE-2026-73695 and CVE-2026-73697 are scored as requiring low privileges. The records do not demonstrate that every installation permits a complete unauthenticated chain to root; do not assume such a chain from the scores alone.

The remaining API issues are an additional boundary: CVE-2026-77877 through CVE-2026-77881 concern a loopback service. Their vectors are local, even where the description calls the resulting execution remote. An attacker must be able to reach that service. Missing-token routes include /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/ and /user_panel_dashboard/. These are not published attack indicators.

CNA affected bounds differ: 1.12 for the redirect flaw; 1.16 for file inclusion, phpini_editor, protected_directory, access_token() and /newpass/; 1.30 for missing API authentication, database restore and blind SQL injection. The vendor changelog lists 1.30 as released October 31 but does not map every CVE to its fix, and does not provide a 1.16 entry. Use the current supported vendor update and confirm coverage rather than treating 1.12 as sufficient. The two-component version labels are the vendor/CNA labels; no version checker is offered.

November 3 update: On rereading, the vendor changelog added 1.30.1 LTS, a security and stability release recommended for every server. It further requires API keys for each API v1 call on port 2304, limits internal migration routes to the local server, and hardens account actions, one-time login links and HTTPS update downloads. Check that an existing /usr/local/cwp/.conf/api_strict_guard_off switch is not disabling the strict guard. The changelog still does not map all nine CVEs individually, so this is the current vendor-recommended update rather than an inferred first fix for every flaw. Test integrations and mail after updating: servers still on the old default mail trust list are changed to 127.0.0.0/8, and applications on other private-network machines must use SMTP authentication.

What’s in the bowl

CVE-2026-73695CVSS 8.7

Local PHP file inclusion

Before 1.16, the module parameter in services/users/index.php can escape its include directory; the CNA rates this low-privileged access.

CVE-2026-73696CVSS 9.3

Execution after login redirect

Before 1.12, a login redirect does not stop PHP execution, letting unauthenticated requests reach protected user-panel functions.

CVE-2026-73697CVSS 8.7

phpini_editor file write and commands

Before 1.16, module access permits unconstrained file writes through acc=update and shell injection through acc=addlabelphpiniadv; CNA rates privileges required as low.

CVE-2026-77876CVSS 9.3

protected_directory command injection

Before 1.16, the file POST parameter in acc=deletedp reaches a shell command in the user-panel context.

CVE-2026-77877CVSS 8.6

Missing loopback API authentication

Before 1.30, callers that can reach the loopback API can invoke root-privileged routes without an access token.

CVE-2026-77878CVSS 8.6

Database-restore API command injection

Before 1.30, a reachable /v1/restoredatabase/ route passes a POST file path into a root shell command.

CVE-2026-77879CVSS 8.5

API authentication SQL injection

Before 1.16, authorization_code and client_id are interpolated into a root MySQL query in access_token(); loopback API access is required.

CVE-2026-77880CVSS 8.6

Password-route root command injection

Before 1.16, the loopback /newpass/ route uses an unescaped POST user value in a root shell command.

CVE-2026-77881CVSS 6.9

Loopback blind SQL injection

Before 1.30, the user parameter in /user_panel_dashboard/, later /valid_token/, enters a root database query; loopback API access is required.

Fixed versions

Product	Safe from	Note
Control Web Panel current vendor release	`1.30.1`	Vendor November 3 LTS security update; CNA affected bounds are 1.12, 1.16 or 1.30. Verify each applicable fix

Crime-scene timeline

Sep 8, 2026
Vendor releases CWP 1.12
The changelog says security improvements without mapping these CVEs.
Oct 31, 2026
Vendor releases CWP 1.30
The current changelog includes further user-panel and internal API hardening.
Nov 2, 2026
VulnCheck publishes nine related CVE records
Detailed public disclosure date, distinct from the earlier release dates.
Nov 3, 2026
Vendor releases 1.30.1 LTS and recommends it for every server
Further hardens API-key checks, internal calls, one-time login links and update downloads; default mail trust networks also narrow.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Control Web Panel changelogPrimaryVendor release dates, current update workflow and security changes; no per-CVE patch mapping.
VulnCheck CVE-2026-73695PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
VulnCheck CVE-2026-73696PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
VulnCheck CVE-2026-73697PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
VulnCheck CVE-2026-77876PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
VulnCheck CVE-2026-77877PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
VulnCheck CVE-2026-77878PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
VulnCheck CVE-2026-77879PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
VulnCheck CVE-2026-77880PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
VulnCheck CVE-2026-77881PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.

Wipe guide

The wipe checklist

0 of 5 sheets used

Upgrade the actual CWP installationUse Settings > CWP Settings > CWP updates and the supported update channel. The vendor’s Update page shows installed/latest versions and an update log. Choose the now-published 1.30.1 LTS or an applicable later release. Confirm the version and completed update afterward; ask support to verify coverage of all nine CVEs. Do not stop at the 1.12 auth-bypass boundary.
Restrict user-panel and internal API accessAs a precaution, limit panel access to trusted management paths. Check that loopback API services are not exposed through public binds, proxies or forwarding. Local callers or server-side request paths may still reach loopback; public-panel filtering alone does not fix API bugs.
Preserve and review panel activityAs a precaution, retain panel/web access logs and compare requests involving module, phpini_editor, protected_directory and the API routes listed below with approved activity. Review unexpected file, account, configuration or database changes. Route names are vulnerable surfaces, not proof of exploitation; the advisories publish no attack IoCs.
Escalate unexplained privileged changesPreserve evidence and involve your hosting provider or incident responder if unapproved commands or root-level changes are found. Patching does not undo an existing compromise. The disclosures do not supply a forensic cleanup procedure.
Verify API and mail behavior after updatingVersion 1.30.1 hardens API keys and one-time login links. Check whether /usr/local/cwp/.conf/api_strict_guard_off disables the strict API guard and confirm integrations still require authorization; do not restore functionality by disabling protection. If mail trust changes from old defaults to 127.0.0.0/8, configure SMTP authentication on other private-network machines. Test legitimate integrations and mail delivery.