CVE-2026-29810

Received Received - Intake

CyberPanel Logic Error Before 2.4.4

Publication date: 2026-09-13

Last updated on: 2026-09-14

Assigner: MITRE

Description

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-14

Generated

2026-10-04

AI Q&A

2026-09-13

EPSS Evaluated

2026-10-03

NVD

CVE-2026-29810

EUVD

EUVD-2026-77074

Affected Vendors & Products

Vendor	Product	Version / Range
cyberpanel	cyberpanel	to 2.4.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-390	The product detects a specific error, but takes no actions to handle the error.

Attack-Flow Graph

Executive Summary

CyberPanel before version 2.4.4 has a logic flaw where a required 'return 0' statement is missing in the code. This omission can lead to ambiguous behavior in the system's business logic, potentially causing improper access control or unexpected outcomes.

Detection Guidance

This vulnerability is specific to CyberPanel versions before 2.4.4 and involves missing logic in access control. To detect it, check your CyberPanel version using the command 'cyberpanel version' or inspect the source code for the absence of 'return 0' in the 'checkOwnership' function in 'plogical/acl.py'.

Impact Analysis

This vulnerability could allow unauthorized users to bypass intended access controls or cause the system to behave unpredictably. The CVSS score of 4.3 indicates a moderate risk, primarily affecting users with local access or those interacting with the system.

Compliance Impact

The provided CVE data does not specify how this vulnerability affects compliance with standards like GDPR or HIPAA. The vulnerability involves missing a required 'return 0' statement in CyberPanel before version 2.4.4, which may lead to ambiguous behavior but lacks details on regulatory impacts.

Mitigation Strategies

Update CyberPanel to version 2.4.4 or later to address the missing return 0 statement in the business logic.

Hi! I’m here to help you understand CVE-2026-29810. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70