CVE-2026-77877: Missing access_token() gate on sensitive loopback routes
Several root-owned user API routes on 127.0.0.1:2302 lacked authentication. Combined with command-injection sinks this turns any local hosting-user foothold into root.
Executive Summary & Technical Impact
Several root-owned user API routes on 127.0.0.1:2302 lacked authentication. Combined with command-injection sinks this turns any local hosting-user foothold into root.
Tracked under CVE-2026-77877 (CWE-306 (Missing Authentication for Critical Function)), this vulnerability affects CWP before 1.29 and carries a severity score of 8.8 (HIGH). Engineering and security operations teams running Control Web Panel (CWP) user API (127.0.0.1:2302) should prioritize upgrading to CWP 1.27/1.29 (per-route token gates and input validation).
Remediation & Patch Guidance
- Upgrade to CWP 1.29 or later.
- Confirm the user API remains bound to loopback only.
Frequently Asked Questions (CVE-2026-77877)
What versions are affected by CVE-2026-77877?
CVE-2026-77877 affects CWP before 1.29 in Control Web Panel (CWP) user API (127.0.0.1:2302) (Missing access_token() gate on sensitive loopback routes).
How do I patch or remediate CVE-2026-77877?
Upgrade affected deployments to CWP 1.27/1.29 (per-route token gates and input validation) and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-77877?
CVE-2026-77877 is rated HIGH with a CVSS score of 8.8 (vector: Local (loopback); reachable after hosting-user foothold; enables root sinks).
