High severity8.4NVD Advisory· Published Nov 2, 2026· Updated Nov 2, 2026
CVE-2026-77877
CVE-2026-77877
Description
Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <1.30
- Range: <1.30
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.