CVE-2026-73696
CriticalCVSS 9.1Summary
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex). A missing exit() call after a header('Location: ...') redirect allows unauthenticated attackers to continue PHP execution past the redirect and reach user panel functionality that should require authentication.
Risk Assessment
An unauthenticated attacker can bypass the login mechanism and access user panel functionality, potentially leading to unauthorized actions on the system. This is a serious access control violation.
Recommendation
Upgrade Control Web Panel to version 1.12 or later. Until patched, consider restricting user panel access from untrusted networks and monitor for unusual requests to CWPUserIndex.
Other vulnerabilities in Control Web Panel (CWP)
See all- CVE-2025-67888High
An issue was discovered in Control Web Panel (CWP) before version 0.9.8.1209, where user input passed via the 'key' GET parameter to /admin/index.php is not properly sanitized. This vulnerability allows unauthenticated attackers to inject and execute arbitrary OS commands with root privileges on the web server.
- CVE-2026-77876Critical
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module. Unescaped input from the file POST parameter in the acc=deletedp action is passed directly into a shell_exec call, allowing attackers to execute arbitrary commands in the user panel context.
Original NVD description (English source)
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS