PT-2026-42014 · Ctrlpanel · Ctrlpanel

Published 2026-05-19 · Updated 2026-05-20 · CVE-2026-34233

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CtrlPanel versions prior to 1.2.0

Description Multiple admin controllers expose DataTable endpoints that lack authorization checks. This allows any authenticated user, regardless of their assigned role, to access sensitive administrative data via GET requests. Although these routes use the '/admin/' prefix, the associated middleware fails to enforce admin-level permissions on the datatable() functions. This can lead to the exposure of user personally identifiable information (PII), payment and transaction records, active voucher and coupon codes, role and permission structures, server ownership mappings, and support ticket contents.

Recommendations Update to version 1.2.0.

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2026-34233

Affected Products

Ctrlpanel

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-34233 · Security Note
• https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-mj5g-j7fq-7hc4 · Note
• https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0 · Note
• https://t.me/CVEtracker/54285 · Telegram Post
• https://twitter.com/CVEnew/status/2056870179519221910 · Twitter Post
• https://t.me/cveNotify/164219 · Telegram Post