CtrlPanel CVE-2026-34358

The attacker must hold a valid authenticated CtrlPanel session on a vulnerable instance (≤1.1.1) but does not need any admin write permission, the login_as permission, or user interaction; the vulnerability is reachable against default configurations because the missing checks are in the controllers themselves rather than gated by an optional feature. Limiting factors: self-registration must be enabled (or the attacker must otherwise obtain any user-tier account), the instance must be network-reachable to the attacker, and exploitation of the logBackIn() path additionally requires that an admin has an active 'Login as User' impersonation session to interfere with. No specific platform, PHP/Laravel version, or non-default setting is required.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1 High) correctly reflects a network-reachable, low-complexity, low-privilege attack with no user interaction yielding high confidentiality and integrity impact and no availability impact - consistent with full takeover via direct API calls by any logged-in user. There is no EPSS score, KEV listing, or public POC provided in the inputs, so real-world exploitation is currently unproven; however the bug is trivially reachable by anyone with a registered account, which on a public hosting-provider portal is effectively the entire user base, making the practical exploitability ceiling far higher than PR:L alone suggests. The constraint is that an attacker must hold a valid (non-admin) authenticated session, so exposure scales with how open self-registration is on a given deployment. No conflicting signals were identified; the primary unknown is whether any in-the-wild abuse has occurred, since the only references are the GitHub Security Advisory and the 1.2.0 release.

An attacker registers (or already holds) an ordinary CtrlPanel user account, obtains the session cookie or API token from the normal login flow, and issues a direct POST to /admin/users/{id} setting their own role to admin or PATCHes their own credits balance. With no public POC identified, exploitation would currently require an attacker to craft the requests from the controller routes documented in the advisory, but the request shapes are trivial because the form templates are still accessible to admins and the field names are visible in the open-source codebase.