CVE-2026-29810: CyberPanel Logic Error Vulnerability

CVE-2026-29810 Overview

CVE-2026-29810 is a business logic flaw in CyberPanel versions prior to 2.4.4. The vulnerability stems from a missing return 0 statement in the access control logic located in plogical/acl.py. When the required return value is omitted, the function fails to explicitly deny access in a branch that should reject the caller, leading to inconsistent authorization decisions. The flaw is categorized under [CWE-390] (Detection of Error Condition Without Action). An authenticated user on the network can trigger the affected code path to obtain limited information they should not be able to read.

Critical Impact
Authenticated users can bypass an access control check in CyberPanel due to a missing return value, causing limited confidentiality impact on multi-tenant hosting environments.

Affected Products

CyberPanel versions before 2.4.4
CyberPanel plogical/acl.py access control module
CyberPanel websiteFunctions/website.py child domain enumeration logic

Discovery Timeline

2026-09-13 - CVE-2026-29810 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-29810

Vulnerability Analysis

CyberPanel is an open-source web hosting control panel. The vulnerable function in plogical/acl.py evaluates whether an administrator owns a given child domain. The intended business logic returns 1 when ownership matches and 0 otherwise. Before version 2.4.4, the else branch that should return 0 was missing entirely, causing the function to fall through without an explicit deny decision. Callers relying on the boolean return value therefore receive an implicit value that does not correctly convey the authorization result.

A related issue in websiteFunctions/website.py filtered child domains using childdomains_set.filter(alais=0), skipping domains that should have been evaluated. The patch restructures the loop to iterate all child domains and apply the alias check inside the loop body, ensuring consistent enumeration.

Root Cause

The root cause is a missing return statement in an authorization branch. Without an explicit return 0, Python functions return None, which is falsy but not equal to 0 under strict comparisons. Downstream callers that check ownership through this function can misinterpret the result, granting limited visibility to domains owned by other accounts.

Attack Vector

Exploitation requires network access and low-privileged authenticated credentials to the CyberPanel interface. No user interaction is required. Successful exploitation exposes limited information about resources belonging to other tenants but does not affect integrity or availability.

python

# Patch in plogical/acl.py — adds the missing return 0 branch
            else:
                if childDomain.master.admin.owner == admin.pk:
                    return 1
+                else:
+                    return 0

        except:
            domainName = Websites.objects.get(domain=domain)

Source: GitHub commit 0a099b1

python

# Patch in websiteFunctions/website.py — corrected child domain iteration
            for web in websites:
-                for child in web.childdomains_set.filter(alais=0):
-                    if child.domain == f'mail.{web.domain}':
-                        pass
-                    else:
-                        childDomains.append(child)
+                for child in web.childdomains_set.all():
+                    if child.alais == 0:
+                        if child.domain == f'mail.{web.domain}':
+                            pass
+                        else:
+                            childDomains.append(child)

Source: GitHub commit 0a099b1

Detection Methods for CVE-2026-29810

Indicators of Compromise

Unexpected access to child domain listings by low-privileged CyberPanel administrator accounts.
Audit log entries showing non-owner accounts enumerating domains outside their assigned scope.
HTTP requests to CyberPanel endpoints that resolve ownership checks referencing domains not associated with the requesting user.

Detection Strategies

Compare CyberPanel version strings against 2.4.4 across all managed hosts to identify vulnerable installations.
Review Django application logs for calls into acl.py ownership functions returning None instead of 0 or 1.
Correlate authenticated session activity with domain ownership records to flag cross-tenant enumeration.

Monitoring Recommendations

Enable verbose logging on CyberPanel web endpoints that manage child domains and website objects.
Forward CyberPanel and web server logs to a centralized log store for retention and query.
Alert on repeated access attempts to child domain listings from accounts with limited assigned resources.

How to Mitigate CVE-2026-29810

Immediate Actions Required

Upgrade CyberPanel to version 2.4.4 or later on all servers.
Audit administrator accounts and remove unnecessary low-privileged access.
Review recent child domain enumeration activity for signs of cross-tenant access.
Rotate credentials for CyberPanel accounts suspected of unauthorized use.

Patch Information

The upstream fix is delivered in CyberPanel 2.4.4. It adds the missing return 0 branch in plogical/acl.py and restructures the child domain iteration in websiteFunctions/website.py. See the GitHub commit for CyberPanel for the complete diff.

Workarounds

Restrict CyberPanel administrative interfaces to trusted networks using firewall rules or a VPN.
Limit issuance of low-privileged administrator accounts until patching is complete.
Manually apply the upstream patch to plogical/acl.py and websiteFunctions/website.py where an immediate upgrade is not feasible.

bash

# Upgrade CyberPanel to the patched release
cd /usr/local/CyberCP
git fetch --all
git checkout v2.4.4
systemctl restart lscpd