CVE-2026-34233
Unauthorized Data Exposure in CtrlPanel Admin Controllers
Publication date: 2026-05-19
Last updated on: 2026-05-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ctrlpanel | ctrlpanel | to 1.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows any authenticated user to access sensitive administrative data, including user personally identifiable information (PII), payment and transaction records, and other confidential information that should be restricted to administrators only.
Such unauthorized access to sensitive data can lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of personal and payment information.
Because the vulnerability exposes PII and payment data without proper authorization checks, it increases the risk of data breaches and unauthorized data disclosure, potentially resulting in regulatory penalties and loss of trust.
Can you explain this vulnerability to me?
This vulnerability exists in CtrlPanel, an open-source billing software for hosting providers, in versions 1.1.1 and earlier. Multiple admin controllers expose DataTable endpoints without proper authorization checks. Although these endpoints are under the /admin/ prefix, the middleware does not enforce admin-level permissions on them. As a result, any authenticated user, regardless of their role, can access these endpoints via GET requests and retrieve sensitive administrative data.
The exposed data includes user personally identifiable information (PII), payment and transaction records, active voucher and coupon codes, role and permission structures, server ownership mappings, and support ticket contents. This issue was fixed in version 1.2.0.
How can this vulnerability impact me? :
Exploitation of this vulnerability allows any authenticated user to access sensitive administrative data that should be restricted to administrators only. This can lead to unauthorized disclosure of user PII, financial transaction details, active discount codes, internal role and permission configurations, server ownership information, and support ticket data.
Such unauthorized access can result in privacy breaches, financial fraud, privilege escalation attempts, and exposure of confidential operational information, potentially harming both the organization and its customers.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if any authenticated user can access the DataTable endpoints under the /admin/ prefix without proper authorization checks.
Specifically, you can attempt to send GET requests to the admin controllers' datatable() methods and observe if paginated JSON responses containing sensitive administrative data are returned.
Since the vulnerability involves endpoints reachable via GET requests without role verification, commands such as curl can be used to test access.
- curl -i -b 'auth_cookie=your_auth_cookie' https://your-ctrlpanel-domain/admin/some_controller/datatable
- Check if the response contains sensitive data such as user PII, payment records, vouchers, roles, or support tickets.
If such data is accessible to non-admin authenticated users, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade CtrlPanel to version 1.2.0 or later, where this vulnerability has been fixed.
Until the upgrade can be performed, restrict access to the /admin/ datatable endpoints to only trusted administrator accounts by implementing proper authorization checks or temporarily disabling these endpoints.
Additionally, review and tighten middleware or access control configurations to ensure that admin-level authorization is enforced on all /admin/ prefixed routes.