Control Web Panel CVE-2026-77879

The vulnerable endpoint is the CWP loopback API authentication gate access_token(); per the CVSS AV:L designation and the 'loopback API' wording, exploitation requires the request to reach the loopback/localhost interface - i.e., local access on the server or a pivot such as SSRF or an intermediary that proxies to 127.0.0.1 - rather than direct remote access against a default internet-facing configuration. No authentication is required (PR:N): the flaw lies in the auth gate itself, and the attacker supplies malicious authorization_code and client_id values that are interpolated into a query executed as MySQL root. Affected: Control Web Panel before webpanel_version 1.16. Limiting factors: the local/loopback reachability requirement is the primary constraint on real-world exploitation; there is no user-interaction requirement and the trigger complexity is low once the endpoint is reachable.

The signals are moderately strong but bounded by the attack vector. The supplied CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) describes a LOCAL-vector, low-complexity, unauthenticated flaw with high confidentiality and high integrity impact and no availability impact - consistent with a loopback (localhost-bound) API as the description states ('loopback API authentication gate'). The high impact is justified: the query runs against MySQL as root, the injection reads arbitrary database contents (VC:H), and it forges the authentication result to bypass the gate (VI:H). The key tension is AV:L versus the intuition that an 'API' SQLi is network-reachable: because the endpoint is a loopback API, direct remote exploitation against a default deployment is NOT implied - reaching it requires local access on the host or a pivot (e.g., SSRF or an intermediary that forwards to 127.0.0.1). No EPSS score was provided, there is no CISA KEV listing (so no confirmed active exploitation), and the input does not mark a working PoC as available - only a VulnCheck advisory reference exists, which is not verified as working exploit code. The vuln.today decision label is 'this_week' (prompt, not emergency), and a vendor patch is available. Net: a genuine high-severity flaw (unauthenticated auth bypass + root-level SQLi) whose real-world urgency is tempered by the local/loopback vector and the absence of KEV/EPSS/confirmed-PoC evidence. CWP has a history of being targeted, so patching within the vendor-implied window is warranted.

An attacker who can reach the CWP loopback API (via local access on the server, or by chaining an SSRF/proxy that forwards to localhost) sends a request to the access_token() gate with SQL metacharacters embedded in the authorization_code and client_id parameters. Because these values are interpolated directly into a query executed as MySQL root, the attacker reads arbitrary database contents and manipulates the query so the authentication check returns success, bypassing the gate. No working public exploit is identified in the input - only a VulnCheck advisory reference, which is not verified as working exploit code.