CVE-2026-77877

8.4 HIGH

Published 2026-11-02 · Updated 2026-11-02

AI risk analysis

Summary: Control Web Panel (CWP) before version 1.30 lacks authentication checks on loopback API routes, allowing local attackers to invoke root-privileged endpoints without a valid access token.
Exploitability: Exploitation requires local access to the loopback interface (127.0.0.1), but no authentication or user interaction is needed beyond that.
Blast radius: An attacker gaining access to the loopback service can execute arbitrary root-level operations, including restoring databases, accessing user data, and modifying system configurations.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to CWP version 1.30 or later, which patches the missing authentication vulnerability.

auth-bypasslocalroot-privilegeapicwp

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-306

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.