CVE-2026-77879: Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API

Q: Which deployments are affected?

Control Web Panel deployments with a webpanel_version earlier than 1.16 are affected. The vulnerable authentication gate is part of the loopback API.

Q: What does an attacker need to exploit this issue?

An attacker needs the ability to submit crafted authorization_code and client_id values to the access_token() API authentication gate. The issue does not require user interaction, but the supplied data does not state what network access or endpoint exposure is required.

Q: What can successful exploitation allow?

Successful SQL injection can read arbitrary database contents and forge the authentication result. This bypasses the API authentication check, and the affected code connects to MySQL as root.

Q: How can I determine whether I am affected?

Check the installed CWP webpanel_version. Versions before 1.16 are affected; version 1.16 is the stated fixed threshold.

Published Nov 2, 2026

Updated

Control Web Panel (CWP) before webpanelversion 1.16 contains a SQL injection vulnerability in the loopback API authentication gate accesstoken(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorizationcode and clientid parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Control Web Panel (CWP) to a version that resolves this vulnerability.
Fixed in 1.16

Event History

Nov 2, 2026

CVE Published

via MITRE·03:20 PM

Data Sourced

via MITRE·03:20 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Control Web Panel deployments with a webpanel_version earlier than 1.16 are affected. The vulnerable authentication gate is part of the loopback API.

What does an attacker need to exploit this issue?

An attacker needs the ability to submit crafted authorization_code and client_id values to the access_token() API authentication gate. The issue does not require user interaction, but the supplied data does not state what network access or endpoint exposure is required.

What can successful exploitation allow?

Successful SQL injection can read arbitrary database contents and forge the authentication result. This bypasses the API authentication check, and the affected code connects to MySQL as root.

How can I determine whether I am affected?

Check the installed CWP webpanel_version. Versions before 1.16 are affected; version 1.16 is the stated fixed threshold.

CVE-2026-77879: Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What can successful exploitation allow?

How can I determine whether I am affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What can successful exploitation allow?

How can I determine whether I am affected?