The vulnerability is a broken access control flaw where certain write endpoints in CtrlPanel's admin API lack proper authorization checks. As a result, any authenticated user can invoke POST or PATCH requests to endpoints that create or modify data, such as coupons, vouchers, partners, shop product pricing, user roles, and server ownership. The attacker can generate unlimited coupons, alter discounts, reassign servers, and even change other users’ passwords and roles, resulting in full administrative control over the system. The weakness corresponds to improper authorization, as defined by common security taxonomy.

The affected product is CtrlPanel from vendor Ctrlpanel-gg. Versions 1.1.1 and earlier are impacted because they contain the missing authorization logic on multiple write controllers: ApplicationApiController, CouponController, PartnerController, ShopProductController, UsefulLinkController, VoucherController, ProductController, ServerController, UserController, and ActivityLogController. These vulnerabilities allow users without administrative write privileges to perform privileged operations. The issue was resolved by applying the patch released in version 1.2.0.

The CVSS score of 8.1 indicates high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploit activity. However, because the flaw requires only authenticated access and the write endpoints are widely used, it is highly exploitable in practice. Attackers can bypass role-based access control simply by sending crafted requests to the exposed API routes, leading to a full compromise of the application’s data integrity, confidentiality, and availability.