CVE-2026-77877: Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access

Q: Who can exploit this issue?

An attacker must be able to reach CWP's loopback API service. The provided data does not indicate that the service is remotely reachable by default.

Q: What level of access is required to exploit it?

No API access token is required for affected loopback API routes. However, the attacker needs a way to access the loopback API service.

Q: Which versions are affected?

CWP versions before webpanel_version 1.29 are affected. Upgrading to version 1.29 or later addresses the vulnerable version range described.

Q: What can an attacker do after exploitation?

The attacker can invoke root-privileged API routes and perform unauthorized actions. Listed routes include /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/.

Published Nov 2, 2026

Updated

Control Web Panel (CWP) before webpanelversion 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /lastaccess/, /validuser/, /validtoken/, and /userpaneldashboard/ to perform unauthorized actions with root privileges.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Control Web Panel (CWP) to a version that resolves this vulnerability.
Fixed in 1.29

Event History

Nov 2, 2026

CVE Published

via MITRE·03:19 PM

Data Sourced

via MITRE·03:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Event

via NVD·04:17 PM

Frequently Asked Questions

Who can exploit this issue?

An attacker must be able to reach CWP's loopback API service. The provided data does not indicate that the service is remotely reachable by default.

What level of access is required to exploit it?

No API access token is required for affected loopback API routes. However, the attacker needs a way to access the loopback API service.

Which versions are affected?

CWP versions before webpanel_version 1.29 are affected. Upgrading to version 1.29 or later addresses the vulnerable version range described.

What can an attacker do after exploitation?

The attacker can invoke root-privileged API routes and perform unauthorized actions. Listed routes include /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/.

CVE-2026-77877: Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of access is required to exploit it?

Which versions are affected?

What can an attacker do after exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of access is required to exploit it?

Which versions are affected?

What can an attacker do after exploitation?