CVE-2026-77877 Control Web Panel (CWP) < 1.30 Unauthenticated Loopback API Root Access

Control Web Panel CWP before webpanelversion 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/,...