Executive brief
CyberPanel is a web hosting control panel used by hosting providers to manage customer domains and hosting accounts. The vulnerability involves a lack of audit logging for actions that modify child domains, allowing administrators or attackers with panel access to make unauthorized changes without leaving a detectable record.
Technical details
CyberPanel before version 2.4.4 does not implement logging for operations that manipulate the child domains list. This is an accountability and audit trail weakness rather than a direct execution vulnerability. The vulnerability requires authenticated access to the control panel. Attackers with administrative or elevated privileges could modify child domain configurations without creating audit logs, hindering forensic investigation and compliance reporting. The fix was implemented in version 2.4.4 with the addition of logging controls in the acl.py and website.py components.
Affected products
- CyberPanel CyberPanel before 2.4.4
Timeline
- 2026-09-13: disclosed
- 2026: patched: Version 2.4.4 released with logging controls added to acl.py and website.py