PT-2026-30020 · Pypi · Ajenti-Panel

Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-35175

OSV

CVSS v4.0

7.2

High

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L

Impact

An authenticated user (using the auth users plugin authentication method) could install a custom package even if this user is not superuser.

Patches

This is fixed in the version 2.2.15. Users should upgrade to this version as soon as possible.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-35175

GHSA-73JV-44C3-J5P2

Affected Products

Ajenti-Panel

References · 4

• https://osv.dev/vulnerability/GHSA-73jv-44c3-j5p2 · Vendor Advisory
• https://github.com/ajenti/ajenti · Note
• https://github.com/ajenti/ajenti/security/advisories/GHSA-73jv-44c3-j5p2 · Note
• https://github.com/ajenti/ajenti/releases/tag/v2.2.15 · Note