CVE-2026-77877High· 7.8▾ TwilightControl Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. At…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.
control_web_panel < 1.29Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73697High· 8.8Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor
CVE-2026-77881Medium· 5.5Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter
CVE-2026-104080High· 7.8Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token
CVE-2026-77880High· 7.8Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/
CVE-2026-77879High· 7.1Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API
CVE-2026-77876High· 8.8Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory