< 1.30.6 Authorization Bypass via oauth_authorization_codes
Not on CISA's list of exploited flaws, and not in the news we track.
9.2of 10, critical
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-124021. Nothing runs until you send it.
Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, contact emails, and password hashes.
You are affected if
The fix