Description
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
Published: 2026-09-09
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

CyberPanel versions 2.4.3 through 2.4.5 contain unauthenticated AI Scanner debugging endpoints that reveal administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. An attacker who can reach these endpoints can enumerate panel administrators and recent scanner activity, providing valuable reconnaissance for subsequent attacks on a multi‑tenant installation.

Affected Systems

The flaw affects the CyberPanel product by usmannasir, specifically all releases from 2.4.3 up to and including 2.4.5.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. Because the attack can be performed without authentication and the EPSS score is unavailable, the likelihood of exploitation is uncertain but the vulnerability is publicly disclosed, and it is not listed in the CISA KEV catalogue. A likely attack vector is direct HTTP requests to the unprotected AI Scanner debugging endpoints exposed on the panel's web interface.

Generated by OpenCVE AI on September 9, 2026 at 12:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade CyberPanel to version 2.4.6 or later to remove the exposed debugging endpoints.
  • Configure the web server or firewall to block external access to the AI Scanner debug paths, for example by limiting those URLs to localhost or using an access control list.
  • Regularly review server logs for unusual requests to the previously exposed AI Scanner endpoints and investigate any unauthorized activity.

Generated by OpenCVE AI on September 9, 2026 at 12:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
Title CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
First Time appeared Cyberpanel
Cyberpanel cyberpanel
Weaknesses CWE-200
CPEs cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*
Vendors & Products Cyberpanel
Cyberpanel cyberpanel
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Cyberpanel Cyberpanel
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-09T11:21:06.038Z

Reserved: 2026-09-09T10:32:34.110Z

Link: CVE-2026-87820

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-09T12:17:17.260

Modified: 2026-09-09T12:17:17.260

Link: CVE-2026-87820

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T13:00:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor