« Volver al listado

CVE-2026-34358

Estado: AplazadaAlta (8.1)—

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin controllers enforce permission checks on form display methods but omit equivalent checks on the corresponding write methods, allowing any authenticated user to bypass RBAC via direct POST/PATCH requests.

Leer descripción completaMostrar menos

Controllers missing checks on write methods store() and update() include ApplicationApiController (admin.api.write), CouponController (admin.coupons.write), PartnerController (admin.partners.write), ShopProductController (admin.store.write), UsefulLinkController (admin.useful_links.write), and VoucherController (admin.voucher.write); ProductController (admin.products.edit), ServerController (write/change_owner/change_identifier), and UserController (write/change_email/change_credits/change_username/change_password/change_role/change_referral/change_ptero/change_serverlimit) are missing checks on update() only, and ActivityLogController exposed empty stub store()/update() methods that silently accepted any request. An authenticated attacker without admin write privileges can issue API credentials, generate unlimited coupons and vouchers, assign arbitrary partner commission and discount rates, alter shop product pricing and limits, reassign server ownership or identifiers, and modify user accounts including roles, credits, passwords, and linked Pterodactyl IDs to achieve full privilege escalation, as well as abuse logBackIn() without the login_as permission to interfere with admin impersonation sessions. This issue has been fixed in version 1.2.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de control de acceso rooto en API remota (AV:N, PR:L) que permite a usuarios autenticados bypasear RBAC mediante requests POST/PATCH directos, elevando privilegios de administrador y modificando cuentas, credenciales y datos críticos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationMulti-factor AuthenticationDisable or Remove Feature or ProgramVulnerability ScanningUser Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Ctrlpanel — CtrlpanelAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-34358",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34358",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-20T15:02:50.320581Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Ctrlpanel-gg",
          "product": "panel",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-19T22:16:37.637",
  "references": [
    {
      "url": "https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-pxmw-gj52-9p68",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-pxmw-gj52-9p68",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin controllers enforce permission checks on form display methods but omit equivalent checks on the corresponding write methods, allowing any authenticated user to bypass RBAC via direct POST/PATCH requests. Controllers missing checks on write methods store() and update() include ApplicationApiController (admin.api.write), CouponController (admin.coupons.write), PartnerController (admin.partners.write), ShopProductController (admin.store.write), UsefulLinkController (admin.useful_links.write), and VoucherController (admin.voucher.write); ProductController (admin.products.edit), ServerController (write/change_owner/change_identifier), and UserController (write/change_email/change_credits/change_username/change_password/change_role/change_referral/change_ptero/change_serverlimit) are missing checks on update() only, and ActivityLogController exposed empty stub store()/update() methods that silently accepted any request. An authenticated attacker without admin write privileges can issue API credentials, generate unlimited coupons and vouchers, assign arbitrary partner commission and discount rates, alter shop product pricing and limits, reassign server ownership or identifiers, and modify user accounts including roles, credits, passwords, and linked Pterodactyl IDs to achieve full privilege escalation, as well as abuse logBackIn() without the login_as permission to interfere with admin impersonation sessions. This issue has been fixed in version 1.2.0."
    },
    {
      "lang": "es",
      "value": "CtrlPanel es un software de facturación de código abierto para proveedores de alojamiento. Versiones 1.1.1 y anteriores contienen una vulnerabilidad de control de acceso roto donde múltiples controladores de administración aplican verificaciones de permisos en métodos de visualización de formularios, pero omiten verificaciones equivalentes en los métodos de escritura correspondientes, permitiendo a cualquier usuario autenticado eludir RBAC a través de solicitudes POST/PATCH directas. Los controladores que carecen de verificaciones en los métodos de escritura store() y update() incluyen ApplicationApiController (admin.api.write), CouponController (admin.coupons.write), PartnerController (admin.partners.write), ShopProductController (admin.store.write), UsefulLinkController (admin.useful_links.write) y VoucherController (admin.voucher.write); ProductController (admin.products.edit), ServerController (write/change_owner/change_identifier) y UserController (write/change_email/change_credits/change_username/change_password/change_role/change_referral/change_ptero/change_serverlimit) carecen de verificaciones solo en update(), y ActivityLogController expuso métodos stub vacíos store()/update() que aceptaban silenciosamente cualquier solicitud. Un atacante autenticado sin privilegios de escritura de administrador puede emitir credenciales de API, generar cupones y vales ilimitados, asignar comisiones de socio y tasas de descuento arbitrarias, alterar precios y límites de productos de la tienda, reasignar la propiedad o identificadores del servidor, y modificar cuentas de usuario incluyendo roles, créditos, contraseñas e IDs de Pterodactyl vinculados para lograr una escalada de privilegios completa, así como abusar de logBackIn() sin el permiso login_as para interferir con sesiones de suplantación de administrador. Este problema ha sido solucionado en la versión 1.2.0."
    }
  ],
  "lastModified": "2026-07-24T09:10:00.153",
  "sourceIdentifier": "security-advisories@github.com"
}