Back Sploitus

CVE-2026-124021 Control Web Panel < 1.30.6 Authorization Bypass via oauth_authorization_codes exploit

Sploitus • November 13, 2026

Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, emails, and password hashes.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026 Flaws in Control Web Panel Lead to Account Takeover Risks Control Web Panel (CWP) versions prior to 1.30.6 are affected by two critical vulnerabilities, CVE-2026-124020 and CVE-2026-124021, both disclosed on 2026-11-13. CVE-2026-124020 allows attackers to exploit a host header injection in the password recovery process, potentially leading to account takeover via a poisoned link. CVE-2026-124021 enables an authorization bypass in the API, allowing attackers with a password-recovery token to execute arbitrary commands and access sensitive account information without an API key. Both vulnerabilities have a CVSS score of 9.2, indicating a critical severity level. The flaws impact a widely used hosting panel, which has a history of critical vulnerabilities, raising concerns about potential. Users are advised to upgrade to version 1.30.6 immediately to mitigate these risks. 5 sources 80

Extracted Entities

CVE-2026-124021 Control Web Panel < 1.30.6 Authorization Bypass via oauth_authorization_codes exploit

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (2)