# CVE-2026-29810: CyberPanel control flow bypass in ACL logic

Source: https://junglewise.ai/threats/cve-2026-29810-cyberpanel-control-flow-bypass-in-acl-logic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-29810 · Severity: medium · CVSS 4.3 · Published 2026-09-13

CyberPanel is a web hosting control panel used by hosting providers and administrators to manage websites and server resources. A missing return statement in access control logic allows the application to execute unintended code paths, potentially bypassing security checks and allowing unauthorized operations on hosted websites and accounts.

## Quick answers

**Is CVE-2026-29810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29810 being exploited in the wild.

**How severe is CVE-2026-29810?** Medium severity, with a CVSS score of 4.3, published 13 September 2026.

**Which products and versions are affected?** CyberPanel CyberPanel before 2.4.4.

**Is there a fix for CVE-2026-29810?** A patch was published on 2026-09-13: Fixed in version 2.4.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-29810 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-29810?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CyberPanel before version 2.4.4 contains a control flow vulnerability in its access control list (ACL) logic where a required "return 0" statement was omitted from the business logic. This missing return statement causes the code to continue executing past a security check that should have terminated early, potentially allowing an attacker to bypass access restrictions. The vulnerability affects the acl.py module responsible for enforcing permission boundaries. Exploitation requires network access to the CyberPanel interface; authenticated access may be required depending on the specific affected code path. The vulnerability was fixed in version 2.4.4 by restoring the proper control flow.

## Affected products

- CyberPanel CyberPanel before 2.4.4

## Timeline

- 2026-09-13: disclosed
- 2026-09-13: patched: Fixed in version 2.4.4

## References

- [https://github.com/usmannasir/cyberpanel/commit/0a099b1b193946555fbdd387a28486b1521f9961](https://github.com/usmannasir/cyberpanel/commit/0a099b1b193946555fbdd387a28486b1521f9961)