Ctrlpanel-gg panel up to 1.1.x DataTable Endpoint /admin/ datatable access control

Summaryinfo

A vulnerability identified as critical has been detected in Ctrlpanel-gg panel up to 1.1.x. Affected is the function datatable of the file /admin/ of the component DataTable Endpoint. Performing a manipulation results in access control. This vulnerability is reported as CVE-2026-34233. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Ctrlpanel-gg panel up to 1.1.x. This affects the function datatable of the file /admin/ of the component DataTable Endpoint. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality. The summary by CVE is:

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, multiple admin controllers expose DataTable endpoints without authorization checks, allowing any authenticated user to access sensitive administrative data that should be restricted to administrators only. The affected admin controllers define datatable() methods that are reachable via GET requests but lack any permission or role verification. Because the routes fall under the /admin/ prefix, operators may assume they are protected - however, the middleware applied to this route group does not enforce admin-level authorization on these specific endpoints. As a result, any authenticated user (regardless of role) can query these endpoints and receive paginated JSON responses containing sensitive records. Exploitation can result in enumeration of user PII, payment and transaction records, active voucher and coupon codes, role and permission structure, server ownership mappings and support ticket contents. This issue has been fixed in version 1.2.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-34233 since 03/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 1.2.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-30985). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Ctrlpanel-gg

Name

• panel

Version

• 1.0
• 1.1

Website

• Product: https://github.com/Ctrlpanel-gg/panel/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion