CVE-2026-77877

Control Web Panel (CWP) versions prior to webpanel_version 1.30 are vulnerable to a missing authentication flaw in the loopback API service. This vulnerability allows an attacker who can reach the loopback API to invoke root-privileged API routes without an access token. Specific exploitable endp...