Is CVE-2026-77877 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77877 being exploited in the wild.

How severe is CVE-2026-77877?

High severity, with a CVSS score of 8.4, published 2 November 2026.

Is there a fix for CVE-2026-77877?

Yes: fixed in 1.30. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77877 attacked?

It is attacked from the adjacent network or with local access.

Am I affected by CVE-2026-77877?

Check whether you run Control Web Panel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77877: Control Web Panel missing authentication in loopback API

CVE-2026-77877 · Severity: high · CVSS 8.4 · Published 2026-11-02

Control Web Panel is a Linux hosting management system that provides administrative control over web servers and accounts. The vulnerability allows attackers with access to the local network to bypass authentication on critical API endpoints and execute administrative functions as root, including restoring databases and accessing user accounts. This could lead to complete system compromise and data theft.

Technologies: Control Web Panel. Vendors: Control Web Panel.

Quick answers

Is CVE-2026-77877 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77877 being exploited in the wild.
How severe is CVE-2026-77877?: High severity, with a CVSS score of 8.4, published 2 November 2026.
Which products and versions are affected?: Control Web Panel before 1.30.
Is there a fix for CVE-2026-77877?: Yes: fixed in 1.30. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77877 attacked?: It is attacked from the adjacent network or with local access.
Am I affected by CVE-2026-77877?: Check whether you run Control Web Panel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.30

Technical details

The loopback API service in Control Web Panel before version 1.30 fails to enforce authentication on sensitive endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/. An attacker with local network access can invoke these endpoints without providing an access token, gaining root-level privileges. The vulnerability is a missing authentication check (CWE-306) on critical administrative functions.

Affected products

Control Web Panel Control Web Panel before 1.30

Timeline

2026-11-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.