The vulnerability in Hestia Control Panel is an authorization bypass (CWE-863) that allows a non-ROOT_USER administrator to create cron jobs which run as a protected ROOT_USER system account. The bypass occurs because the system never checks the read‑only flag when handling the /add/cron POST request, enabling the authenticated user to execute arbitrary commands as the privileged administrator. This flaw gives an attacker full code‑execution capability on the host and compromises both confidentiality and integrity of the system.

The affected product is Hestia Control Panel (HestiaCP). Versions prior to 1.10.5, including 1.10.4 and earlier, contain the flaw and are vulnerable to exploitation.

The vulnerability has a CVSS score of 8.6, indicating high severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Attackers must be authenticated as a non‑ROOT_USER administrator, but once authenticated they can log in via the loginas parameter and send a POST request to /add/cron. Because the read‑only check is missing, these requests cause the system to execute the supplied cron command as the protected ROOT_USER account. The attack vector is a remote web‑based administrative interface, and the exploitation requires only standard administrative privileges.