Is CVE-2026-77879 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77879 being exploited in the wild.

How severe is CVE-2026-77879?

High severity, with a CVSS score of 7.7, published 2 November 2026.

Which products and versions are affected?

Control Web Panel CWP before 1.16.

Is there a fix for CVE-2026-77879?

Yes: fixed in CWP 1.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77879 attacked?

It is attacked with local access.

Am I affected by CVE-2026-77879?

Check whether you run Control Web Panel CWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77879: Control Web Panel SQL injection in loopback API authentication

CVE-2026-77879 · Severity: high · CVSS 7.7 · Published 2026-11-02

Control Web Panel (CWP) is a Linux hosting management system that administers web servers, databases, and user accounts. A SQL injection flaw in its API authentication gateway allows unauthenticated attackers to bypass authentication and read the entire database, including sensitive configuration and user data. An attacker exploiting this vulnerability gains complete administrative control over all hosted websites and databases on the server.

Technologies: Control Web Panel CWP. Vendors: Control Web Panel.

Quick answers

Is CVE-2026-77879 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77879 being exploited in the wild.
How severe is CVE-2026-77879?: High severity, with a CVSS score of 7.7, published 2 November 2026.
Which products and versions are affected?: Control Web Panel CWP before 1.16.
Is there a fix for CVE-2026-77879?: Yes: fixed in CWP 1.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77879 attacked?: It is attacked with local access.
Am I affected by CVE-2026-77879?: Check whether you run Control Web Panel CWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: CWP 1.16

Technical details

The access_token() function in CWP's loopback API fails to sanitize attacker-controlled authorization_code and client_id parameters before interpolating them into SQL queries executed as the MySQL root user. An unauthenticated attacker can inject SQL via these parameters to forge authentication tokens and bypass the API's access control, gaining the ability to read and modify database contents without credentials.

Affected products

Control Web Panel CWP before 1.16

Timeline

2026-11-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.