All vulnerabilities
CVE-2026-111627GHSA-vp7q-fjv5-5vg8

HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation

hestiacp hestiacp
Open in ThreatlineRecord JSON
CVSS
8.6High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.57%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.10.5Fixed versionCVE List
Published16 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.

Text from CVE List

Affected versions 1

  • hestiacpaffected: all versions before 1.10.5CVE List

References 6