Control Web Panel CVE-2026-77877

Exploitation requires the attacker to be able to reach the CWP API service bound to the loopback interface (localhost/127.0.0.1) - e.g. a local account on the server, code execution on the host, or an SSRF/reverse-proxy path that can address the loopback service. Once reachable, no access token or authentication is required (PR:N): root-privileged routes such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ can be invoked directly. The key limiting factor is the Local attack vector (AV:L): the service is not intended to be directly network-exposed, so an attacker without loopback access cannot trigger it remotely. Affected: CWP (Control Web Panel) before webpanel_version 1.30; updating to 1.30 or later is the vendor fix.

The CVSS 4.0 base score of 8.6 (High) reflects a missing-authentication flaw (CWE-306) with full confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H) and no privileges or user interaction required (PR:N/UI:N). The single most important moderating signal is the Local attack vector (AV:L): exploitation requires the attacker to be able to reach the loopback-bound API service, so this is not a directly internet-facing pre-auth flaw despite PR:N. That combination - trivial to abuse once you can reach the service, but gated by needing loopback reachability - is why the vuln.today Decision label is 'this_week' rather than act_now/emergency. No EPSS score and no CISA KEV entry were provided in the input, so there is no quantitative exploitation-probability or confirmed-active-exploitation signal to weigh; absence of KEV/EPSS here is missing data, not evidence of low risk. A PoC reference exists but is not verified as working exploit code. Net: this is a genuine high-severity privilege/auth bypass that should be patched promptly, but the Local vector means realistic risk concentrates on multi-tenant hosts, chained SSRF/proxy access to localhost, or already-present local accounts rather than mass internet-wide exploitation.

An attacker who can reach the CWP loopback API service - for example a local shell account on a shared hosting server, or via an SSRF/proxy that can address 127.0.0.1 - sends requests directly to root-privileged API routes such as /v1/restoredatabase/ or /user_panel_dashboard/ without supplying any access token. Because authentication is missing, the API executes these actions with root privileges, letting the attacker read or alter data and perform administrative operations. A public PoC reference exists but is not verified as working exploit code, and the Local attack vector means the attacker must first obtain loopback reachability.