Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-77877Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access

High 7.8

In plain English

A high-severity missing authentication in Control Web Panel from Control Web Panel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 94.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.

Affected products (as reported)

Vendor	Product	Versions
Control Web Panel	Control Web Panel	0 – before 1.29

Weakness: CWE-306 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Changelog release-notes, patch
VulnCheck Blog technical-description, exploit
VulnCheck Advisory: Control Web Panel (CWP) < 1.30 Unauthenticated Loopback API Root Access third-party-advisory