CyberPanel CVE-2026-29811

Requires an active authenticated session on CyberPanel with at least low-privilege (reseller or user-level) credentials - unauthenticated exploitation is not supported by the CVSS PR:L metric. The cross-account integrity impact (S:C) is contingent on a multi-tenant CyberPanel deployment where multiple accounts share the same panel instance and have configured child or alias domains. The vulnerability is confined to the child-domain management functionality (fetchChildDomainsMain and checkOwnership). Limiting factors: authentication is mandatory; single-account or single-tenant deployments expose reduced cross-account risk; the attacker must interact specifically with domain listing and ownership-check code paths. There is no evidence of remotely exploitable pre-auth attack surface.

The vendor-provided CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N scores 7.7 (High). The S:C (Changed Scope) and I:H (High Integrity) pairing is the most significant signal: it implies a low-privilege authenticated user can affect domain records outside their own account on shared multi-tenant installations. AC:L indicates no exploitation complexity beyond possessing valid credentials. No EPSS score is supplied; the issue is absent from CISA KEV; no POC is publicly identified. The combination of no active exploitation evidence and a logic-level bug (not a memory-safety flaw) places real-world risk below what the raw CVSS score implies for single-tenant deployments. However, hosting providers running CyberPanel as a shared control panel for multiple resellers or end-users face meaningful cross-tenant risk. The missing/incorrect CPE (n/a) means this will not be detected by standard NVD-based vulnerability scanners, creating a blind spot for automated tooling.

An attacker with a low-privilege reseller or end-user account on a multi-tenant CyberPanel instance calls the fetchChildDomainsMain endpoint. Because the ORM alias filter misbehaves and the ownership check lacks a proper rejection branch, the attacker retrieves or manipulates child/alias domain records belonging to other accounts on the same panel, altering DNS or hosting configurations across tenant boundaries without authorization.