CVE-2026-736968.6High
CVE-2026-73696: Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex
Vendor fix available · Affected: Control Web Panel · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.04 (4 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.5%probability of exploitation in the next 30 days
42nd percentile
050100
Higher than 42% of scored CVEs
8.6HighCVSS
LowMediumHighCrit.
DescriptionNVD
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 5 Nov.
- Control Web Panel flaws chain to unauthenticated root accessSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.