What is CVE-2026-77879 in Control Web Panel?

Control Web Panel (CWP) before webpanel_version 1.16 contains a critical SQL injection vulnerability tracked as CVE-2026-77879 with a CVSS score of 7.7. The flaw resides within the loopback API authentication gate access_token(), which connects to MySQL as root and directly interpolates parameters controlled by attackers into database queries.

Attackers can leverage this implementation flaw through the authorization_code and client_id parameters. By injecting malicious SQL payloads, unauthorized users can read arbitrary database contents, forge authentication results, and completely bypass the API authentication checks.

Who is affected by this SQL injection vulnerability?

This vulnerability specifically targets administrators and environments running Control Web Panel (CWP) instances prior to version 1.16. Because the loopback API gate executes queries with root database privileges, successful exploitation grants deep access to sensitive database records.

While similar to issues like CVE-2026-58946 or CVE-2026-58957 regarding privilege escalation risks, this specific flaw focuses on API authentication bypass via SQL injection.

How do I secure my server against this flaw?

Mitigating CVE-2026-77879 requires immediate action from system administrators managing CWP servers. You must apply official patches provided by the developers as outlined in their release notes.

Reviewing system logs and restricting access to the loopback API endpoints can also reduce exposure until updates are fully deployed across your infrastructure.

  1. Verify your current Control Web Panel version to check if it is earlier than 1.16.
  2. Check the official documentation at https://control-webpanel.com/changelog for patch availability.
  3. Update Control Web Panel to version 1.16 or higher to resolve the query interpolation flaw.
  4. Inspect MySQL and API access logs for signs of unauthorized parameter manipulation.