Authorization Bypass Vulnerability in Control Web Panel by Control Web Panel

CVE-2026-124021

What is CVE-2026-124021?

Control Web Panel (CWP) versions prior to 1.30.6 are vulnerable to an authorization bypass through a flaw in the validate() function located in api/v1/index.php. Attackers with a password-recovery token and a predictable legacy signature may gain unauthorized access to remote-API functions without a valid API key. This vulnerability can be exploited via the POST /cronjobsusers/ endpoint, granting attackers the ability to inject arbitrary cron commands and execute them within the compromised hosting account. Furthermore, the same token can be misused to access sensitive global account information, including usernames, email contacts, and password hashes, leading to potential account compromise.

References