CVE-2026-77881: /v1/user_panel_dashboard/ (later /valid_token/) client_id SQLi
Blind SQL injection on a tokenless user API route enabling a full database read as MySQL root. Disclosure rather than a second shell path.
Executive Summary & Technical Impact
Blind SQL injection on a tokenless user API route enabling a full database read as MySQL root. Disclosure rather than a second shell path.
Tracked under CVE-2026-77881 (CWE-89 (SQL Injection)), this vulnerability affects CWP before 1.29 and carries a severity score of 8.8 (HIGH). Engineering and security operations teams running Control Web Panel (CWP) user API should prioritize upgrading to CWP 1.29 (cwp_clean_username gate).
Remediation & Patch Guidance
- Upgrade to CWP 1.29 or later.
- Rotate MySQL and panel credentials if compromise is suspected.
Frequently Asked Questions (CVE-2026-77881)
What versions are affected by CVE-2026-77881?
CVE-2026-77881 affects CWP before 1.29 in Control Web Panel (CWP) user API (/v1/user_panel_dashboard/ (later /valid_token/) client_id SQLi).
How do I patch or remediate CVE-2026-77881?
Upgrade affected deployments to CWP 1.29 (cwp_clean_username gate) and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-77881?
CVE-2026-77881 is rated HIGH with a CVSS score of 8.8 (vector: Local loopback; tokenless blind SQL read as MySQL root).
