PT-2026-42014 · Ctrlpanel · Ctrlpanel

CVE-2026-34233 · Published 2026-05-19 · Updated 2026-05-20

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CtrlPanel versions prior to 1.2.0

Description Multiple admin controllers expose DataTable endpoints that lack authorization checks. This allows any authenticated user, regardless of their assigned role, to access sensitive administrative data via GET requests. Although these routes use the '/admin/' prefix, the associated middleware fails to enforce admin-level permissions on the datatable() functions. This can lead to the exposure of user personally identifiable information (PII), payment and transaction records, active voucher and coupon codes, role and permission structures, server ownership mappings, and support ticket contents.

Recommendations Update to version 1.2.0.

Exploit

Fix

Missing Authorization

Improper Access Control

Weakness Enumeration

CWE-862

CWE-284

Related Identifiers

CVE-2026-34233

GHSA-MJ5G-J7FQ-7HC4

Affected Products

Ctrlpanel

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34233.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34233 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34233 · Vendor Advisory
• https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-mj5g-j7fq-7hc4 · Note
• https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0 · Note
• https://t.me/CVEtracker/54285 · Telegram Post
• https://t.me/cveNotify/164219 · Telegram Post
• https://twitter.com/CVEnew/status/2056870179519221910 · Twitter Post