Skip to content
Critical CVE-2026 Flaws in Control Web Panel Lead to Account Takeover Risks

Critical CVE-2026 Flaws in Control Web Panel Lead to Account Takeover Risks

First seen 14 Nov 2026, 15:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 14, 2026 at 15:43 UTC
  • •CWP versions before 1.30.6 are vulnerable to two critical flaws.
  • •CVE-2026-124020 allows account takeover via a poisoned password recovery link.
  • •CVE-2026-124021 enables unauthorized API access and command execution.

Control Web Panel (CWP) versions prior to 1.30.6 are affected by two critical vulnerabilities, CVE-2026-124020 and CVE-2026-124021, both disclosed on 2026-11-13. CVE-2026-124020 allows attackers to exploit a host header injection in the password recovery process, potentially leading to account takeover via a poisoned link. CVE-2026-124021 enables an authorization bypass in the API, allowing attackers with a password-recovery token to execute arbitrary commands and access sensitive account information without an API key. Both vulnerabilities have a CVSS score of 9.2, indicating a critical severity level. The flaws impact a widely used hosting panel, which has a history of critical vulnerabilities, raising concerns about potential. Users are advised to upgrade to version 1.30.6 immediately to mitigate these risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 8h ago How this analysis works

Timeline

2026-11-13
CVE-2026 vulnerabilities disclosed
CWP vulnerabilities CVE-2026-124020 and CVE-2026-124021 were published, revealing critical flaws in the password recovery and API authorization processes.
Sploitus
2026-11-13
CWP version 1.30.6 released
Control Web Panel released version 1.30.6 to address the critical vulnerabilities disclosed on the same day.
Sploitus
2026-11-13
CVE-2026-124021 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-13
CVE-2026-124020 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (5)

Following this threat?

Track CVE-2025-48703 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 4

Common questions

What versions of CWP are affected?
Control Web Panel versions prior to 1.30.6 are affected by the vulnerabilities.
What should I do to protect my system?
Upgrade to Control Web Panel version 1.30.6 immediately to mitigate the vulnerabilities.
Are these vulnerabilities being actively exploited?
No confirmed exploitation has been reported, but the vulnerabilities are critical and should be addressed promptly.