CVE-2026-29811: CyberPanel Information Disclosure Flaw

CVE-2026-29811 Overview

CyberPanel versions before 2.4.4 contain an authorization flaw in the child domain handling logic. The application attempts to detect an alais domain (a misspelling of "alias", referring to a second domain serving the same content as a primary domain) using an Object-Relational Mapping (ORM) query filter instead of a Python if statement conditional check. This flawed pattern causes the filter to exclude records that should have been evaluated separately, allowing authenticated low-privilege users to affect data integrity of child domain listings. The issue is tracked under [CWE-1025: Comparison Using Wrong Factors].

Critical Impact
Authenticated attackers can manipulate child domain visibility and integrity by exploiting the improper ORM filter logic that bypasses intended alias detection checks.

Affected Products

CyberPanel versions prior to 2.4.4
CyberPanel plogical/acl.py access control module
CyberPanel websiteFunctions/website.py child domain listing module

Discovery Timeline

2026-09-13 - CVE-2026-29811 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-29811

Vulnerability Analysis

The vulnerability originates in CyberPanel's child domain enumeration logic. The affected code path applies an ORM filter childdomains_set.filter(alais=0) to narrow results before iterating them. This filter-based approach silently skips domain records with non-zero alais values without providing a code path to handle them appropriately. The patched version replaces the filter with childdomains_set.all() followed by an explicit if child.alais == 0 conditional, ensuring each record is evaluated deterministically in Python rather than filtered at the query layer.

A separate issue in plogical/acl.py is addressed in the same commit. The original ownership check returned 1 when a user owned the domain but had no explicit else branch, allowing the function to fall through to unintended code paths. The patch adds else: return 0 to enforce a definitive deny response when ownership does not match.

Root Cause

The root cause is improper input handling in access control logic. Filtering at the ORM layer collapses two distinct conditions (record existence and alias status) into a single query, removing the ability to apply per-record authorization decisions. Combined with the missing else branch in the ACL check, the result is an authorization bypass affecting integrity of the child domain view.

Attack Vector

The attack requires network access and low-privileged authenticated credentials. No user interaction is required. The scope is changed because the vulnerability impacts data belonging to other user contexts within CyberPanel's multi-tenant hosting environment.

python

# Vulnerable pattern (websiteFunctions/website.py)
for web in websites:
    for child in web.childdomains_set.filter(alais=0):
        if child.domain == f'mail.{web.domain}':
            pass
        else:
            childDomains.append(child)

# Patched pattern
for web in websites:
    for child in web.childdomains_set.all():
        if child.alais == 0:
            if child.domain == f'mail.{web.domain}':
                pass
            else:
                childDomains.append(child)

# ACL fix in plogical/acl.py
else:
    if childDomain.master.admin.owner == admin.pk:
        return 1
    else:
        return 0

Source: CyberPanel commit 0a099b1

Detection Methods for CVE-2026-29811

Indicators of Compromise

Unexpected access patterns to /websites/ and /childDomains/ endpoints from low-privileged accounts
CyberPanel installations running versions earlier than 2.4.4 as reported by /etc/cyberpanel/version
Anomalous child domain listing requests returning results across tenant boundaries

Detection Strategies

Inventory CyberPanel deployments and identify hosts running vulnerable versions prior to 2.4.4
Review web server access logs for authenticated requests to child domain management endpoints originating from non-administrator accounts
Monitor Django ORM query logs, if enabled, for childdomains_set.filter(alais=0) patterns that predate the patch

Monitoring Recommendations

Enable audit logging on CyberPanel administrative actions and forward events to a centralized SIEM
Alert on any modification or enumeration of child domains performed by accounts without administrative roles
Track HTTP response sizes on child domain listing endpoints to detect abnormal data exposure

How to Mitigate CVE-2026-29811

Immediate Actions Required

Upgrade CyberPanel to version 2.4.4 or later as soon as possible
Audit existing low-privileged accounts and revoke unused credentials
Review recent child domain listings and ACL decisions for anomalous entries

Patch Information

The fix is delivered in CyberPanel commit 0a099b1b193946555fbdd387a28486b1521f9961, which introduces explicit Python conditional checks in websiteFunctions/website.py and adds the missing else: return 0 branch in plogical/acl.py. See the CyberPanel commit reference for the full diff.

Workarounds

Restrict network access to the CyberPanel administrative interface using firewall rules or a VPN
Limit account creation and reduce the number of low-privileged users with access to the panel
Apply the upstream patch manually to plogical/acl.py and websiteFunctions/website.py if a full version upgrade is not feasible

bash

# Upgrade CyberPanel to the patched release
sh <(curl https://raw.githubusercontent.com/usmannasir/cyberpanel/stable/preUpgrade.sh || \
    wget -O - https://raw.githubusercontent.com/usmannasir/cyberpanel/stable/preUpgrade.sh)

# Verify installed version
cat /usr/local/CyberCP/version.txt