SQL Injection Vulnerability in Control Web Panel (CWP) by Control Web Panel
CVE-2026-77879

8.5HIGH

Key Information:

Vendor

Control Web Panel

Status
Control Web Panel
Vendor
CVE Published:
2 November 2026

What is CVE-2026-77879?

Control Web Panel (CWP) prior to version 1.16 is susceptible to a SQL injection vulnerability through the loopback API authentication gate's access_token() function. This flaw allows attackers to inject malicious SQL commands via the authorization_code and client_id parameters. By exploiting this vulnerability, attackers can gain unauthorized access to sensitive database information and potentially manipulate authentication results, effectively bypassing the API's security measures.

Affected Version(s)

Control Web Panel 0 < 1.16

References

https://control-webpanel.com/changelog
release-notespatch
https://www.vulncheck.com/advisories/control-web-panel-cw...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
.