CVE-2026-124021 and CVE-2026-124020: Critical Vulnerabilities in Control Web Panel
This text was generated using artificial intelligence (AI).For Control Web Panel (CWP) two critical vulnerabilities have been published: CVE-2026-124021 and CVE-2026-124020. Both affect CWP versions prior to 1.30.6 and achieve a CVSS score of 4.0 according to the CNA advisory (CVE.org) 9.2.
The vulnerabilities affect different functions: an authorization check of the remote API and the password recovery process. In both cases, command execution in the context of the affected hosting account can become possible.
CVE-2026-124021 affects the function validate in api/v1/index.php. An attacker with a password recovery token and a predictable legacy signature can therefore obtain valid authorization for the remote API without using a regular API key.
Through the endpoint /cronjobsusers/ any cron commands can be created according to the advisory. This allows for command execution as the affected hosting account. The same token can also allow access to routes for global account and account details. These routes can expose usernames, contact email addresses, and password hashes.
CVE-2026-124020: Password Recovery Manipulation
CVE-2026-124020 affects the route /v1/lostpass/. Unauthenticated attackers can introduce the HTTP host header into the process for generating a password reset link according to the advisory.
According to the advisory, an automated email security service can invoke a manipulated reset link. This can expose a valid recovery token. The token can then be reused at /login/index.php?acc=newpass to set a new password. Afterwards, the File Manager and Crontab modules can be abused for command execution as the affected hosting account.
Patch Status and Access Restrictions
Control Web Panel provides a fix with version 1.30.6 for both vulnerabilities - details are documented in the Control Web Panel Changelog. CWP installations prior to this version should be prioritized for review and update.
Until the update, external access to /v1/lostpass/ and /api/v1/index.php can be restricted using firewall or WAF rules. Recommended actions include:
Check patch status and exposure.
Update CWP to version 1.30.6 Update.
Prioritize and mitigate affected systems.
Restrict external access to /v1/lostpass/ and /api/v1/index.php .
Establish continuous vulnerability and vendor risk monitoring.
Active exploitation of the two vulnerabilities is not known. However, patch status and external accessibility of the affected functions should still be checked.
DACH context
For hosting providers in Germany and Austria using CWP, reporting obligations under Art. 33 GDPR apply in the event of a successful compromise: If personal data — such as password hashes or contact email addresses — is disclosed without authorization, the responsible supervisory authority must be informed within 72 hours. Providers falling under NIS-2 or the Austrian NISG are subject to additional security and reporting obligations. For operators in Switzerland, the revised Information Security Act (ISG) applies, with reporting obligations to the Federal Office for Cybersecurity (BACS).
LocateRisk: Classifying externally accessible CWP systems
LocateRisk aids in the context of EASM in making publicly accessible systems and deployed software under their own domains visible. This allows for the examination of externally accessible CWP instances to begin - including forgotten subdomains or untracked hosting environments that are not captured in the regular asset inventory.
The platform does not necessarily identify the specifically vulnerable version. The technical validation of the version as well as the application of the vendor fix remain operational tasks. Additionally, Cyber Vendor Risk Management (C-VRM) can provide insights when critical vulnerabilities are published by technology providers or when their security level changes.
Am I affected?
This concerns Control Web Panel in the versions mentioned above; the vulnerability was fixed in 1.30.6. Those who want to know if Control Web Panel is at all visible in their own externally accessible infrastructure can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
CVE-2026-124021 is a critical vulnerability in Control Web Panel (CWP) prior to version 1.30.6. It affects the authorization check of the remote API and may allow attackers to gain access without a valid API key and execute arbitrary commands.
As an immediate workaround, external access to the endpoints /v1/lostpass/ and /api/v1/index.php can be restricted via firewall or WAF rules. The permanent solution is to update to version 1.30.6.
Status: November 13, 2026. This contribution serves general informational purposes and is not legal, security, or individual advisory. The security situation and patch availability may have changed since publication; the linked manufacturer advisory is always decisive. Despite careful research, we do not guarantee the timeliness, correctness, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-124021
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français