Information Disclosure Vulnerability in CyberPanel by Usman Nasir
CVE-2026-87820

6.9MEDIUM

Key Information:

Vendor

Usmannasir

Status
Cyberpanel
Vendor
CVE Published:
9 September 2026

What is CVE-2026-87820?

Versions 2.4.3 through 2.4.5 of CyberPanel expose critical debugging endpoints of the AI Scanner, which can be accessed without authentication. This vulnerability allows unauthorized attackers to gain access to sensitive information including administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. As a result, attackers can effectively inventory multi-tenant installations and potentially execute follow-on attacks by leveraging the exposed data.

Affected Version(s)

cyberpanel 2.4.3 < 2.4.6

cyberpanel 2.4.6

References

https://github.com/usmannasir/cyberpanel/security/advisor...
vendor-advisory
https://github.com/usmannasir/cyberpanel/commit/20484fd17...
patch
https://www.vulncheck.com/advisories/cyberpanel-2.4.3-thr...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

enrik-m
.