CVE Alert: CVE-2026-124021 – Control Web Panel

Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, emails, and password hashes.

**Risk verdict:** This is a high-impact remote weakness; urgency is uncertain because KEV, SSVC, EPSS and PoC indicators were not provided.

**Why this matters:** A qualifying recovery token could enable command execution within a hosting account and expose account details and password hashes. Likely attacker goals include deploying a web shell, stealing credentials, establishing persistence through scheduled tasks, or abusing hosted sites; impact on other accounts is not established.

**Most likely attack path:** The service is network-reachable, with no prior privileges or user interaction indicated; a prerequisite token and legacy signature are required, so how readily an attacker can obtain them remains unclear. A successful attack could run commands as the affected account. The unchanged Scope rating does not indicate automatic impact beyond the vulnerable security authority.

**Who is most exposed:** Internet-facing hosting control panels on VPS and shared-hosting servers are the main concern, particularly where recovery functions and API routes are publicly reachable.

Review requests to `/cronjobsusers/` for unusual sources, authentication failures or unexpected command additions.

Check panel/API worker process trees for shells, scripting tools and unexpected outbound connections.

Audit hosting-account crontabs and recent changes.

Review recovery-token use and access to account-list or account-detail routes.

Mitigation and prioritisation

Upgrade to a release containing the fix; prioritise internet-exposed instances.

Invalidate outstanding recovery tokens and rotate credentials for potentially exposed accounts.

Restrict panel/API access to trusted networks where feasible; preserve logs and investigate before cleanup.

Test the update and any endpoint restrictions through normal change management.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.