CVE-2026-111627

Name of the Vulnerable Software and Affected Versions HestiaCP versions prior to 1.10.5

Description An authorization bypass allows administrators who are not the ROOT USER to perform write actions by impersonating the protected ROOT USER account. This occurs because the read-only flag is not verified when a user logs in via the loginas parameter and sends a POST request to the '/add/cron/' endpoint. Consequently, the crond service executes the commands under the system account of the protected administrator.

Recommendations Update HestiaCP to version 1.10.5 or later. Avoid using the loginas parameter to access the '/add/cron/' endpoint until the update is applied.