CVE-2026-77877

Control Web Panel (CWP) before webpanel version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last access/, /valid user/, /valid token/, and /user panel dashboard/ to perform unauthorized actions with root privileges.