CVE-2026-111627: HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOTUSER administrators to perform write actions while impersonating the protected ROOTUSER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated access as a non-ROOT_USER HestiaCP administrator. The issue does not describe exploitation by unauthenticated users.
What access does successful exploitation provide?
The attacker can create cron jobs while impersonating the protected ROOT_USER account. The scheduled commands run as that protected administrator's system account, allowing high-impact read and write actions.
Are installations before 1.10.5 affected by default?
The provided information identifies HestiaCP versions before 1.10.5 as affected, but it does not state whether any particular default configuration is required. Exploitation relies on the loginas parameter and the ability to POST to /add/cron/.
How can I determine whether my deployment is exposed?
Verify whether the HestiaCP version is earlier than 1.10.5 and whether non-ROOT_USER administrator accounts exist. Review requests and audit records for use of the loginas parameter followed by POST requests to /add/cron/, and inspect cron entries associated with the protected administrator account.