CVE-2026-77877

The record

Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.

Affected packages

Related vulnerabilities

• CVE-2026-121736 NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the… CWE-306
• CVE-2022-29966 Emerson Ovation has several protocols that have no authentication, which could allow an… CWE-306
• CVE-2026-63482 Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics… CWE-306
• CVE-2026-121557 WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that… CWE-306
• CVE-2026-121555 Foxel through 2.4.0 contains a missing authentication vulnerability that allows… CWE-306
• CVE-2026-121454 Padloc through 4.3.0 contains a missing authentication vulnerability in… CWE-306
• CVE-2026-119740 Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated… CWE-306
• CVE-2026-119731 Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its… CWE-306