CVE-2026-29812: Medium severity CyberPanel CyberPanel vulnerability

Q: What access does an attacker need to abuse this issue?

The vulnerability requires low-privileged authenticated access (PR:L). It is remotely reachable and does not require user interaction.

Q: Is there evidence that this vulnerability directly changes child domains?

The available information identifies missing logging for actions that could potentially manipulate the child domains list. It does not confirm that the flaw itself permits unauthorized modification or identify specific affected actions.

Q: How can administrators determine whether they are affected?

CyberPanel versions before 2.4.4 are affected. Because the issue is missing logging, administrators may be unable to use application logs to retrospectively identify relevant child-domain-list manipulation actions.

Published Sep 13, 2026

Updated

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.

Affected Software

1 affected component

CyberPanel CyberPanel<2.4.4

Event History

Sep 13, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to abuse this issue?

The vulnerability requires low-privileged authenticated access (PR:L). It is remotely reachable and does not require user interaction.

Is there evidence that this vulnerability directly changes child domains?

The available information identifies missing logging for actions that could potentially manipulate the child domains list. It does not confirm that the flaw itself permits unauthorized modification or identify specific affected actions.

How can administrators determine whether they are affected?