Control Web Panel CVE-2026-77881

The attacker must be able to reach a loopback-bound API route (originally /user_panel_dashboard/, later /valid_token/) on a CWP instance running a version before 1.30 - this requires local access to the server or an SSRF/relay primitive in another service, since the route is not exposed on the public network (AV:L). Given that reachability, no authentication is required (PR:N) and no user interaction or special configuration is needed; the 'user' parameter is injectable by default. Extraction runs through a MySQL connection made as root against the oauth_clients table, so a successful attacker can read arbitrary database contents. The principal limiting factor is the loopback binding (local vector); the practical cost is that it is time-based blind injection, so data extraction is slow and must be inferred bit-by-bit.

This is a genuine but second-tier priority rather than a drop-everything emergency, and the deciding signal is the attack vector. The supplied CVSS 4.0 vector is AV:L/AC:L/AT:N/PR:N/UI:N with VC:H only (score 6.9), and the description confirms the reason for AV:L: the vulnerable route is an unauthenticated loopback API route, i.e. bound to the local interface rather than exposed to the network. That single fact sharply limits real-world reach - an attacker cannot hit this directly from the internet and needs either local presence on the host or a request-relay primitive (e.g. SSRF/proxy) to reach the loopback listener. Once reachable, exploitation is easy: no authentication (PR:N) and low complexity (AC:L), and because the backend query runs against MySQL as root, confidentiality impact is high (VC:H) - arbitrary database contents, including credentials, can be read. Integrity and availability are untouched (VI:N/VA:N), consistent with a blind read-only extraction. The vuln.today decision label is 'this_month' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score provided, so there is no signal of active or widespread exploitation. The signals are internally consistent - none of them conflict - but note that EPSS and KEV data are simply absent here rather than low, so exploitation likelihood cannot be quantified from the input. Net: patch within a normal cycle; it warrants faster attention on any host where the loopback interface is reachable through other services or where untrusted local/tenant access exists.

An attacker who already has local access to a CWP host, or who can relay requests to its loopback interface via an SSRF or proxying flaw in another service, sends crafted requests to the unauthenticated /valid_token/ route (originally /user_panel_dashboard/) with a malicious 'user' parameter. Because the parameter is interpolated directly into a query run as MySQL root, time-based blind SQL injection lets them extract arbitrary database contents, including stored credentials. No public exploit code is identified in the provided data; only a VulnCheck advisory reference is present.