Description
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
Published: 2026-09-09
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Exposure
Action: Immediate Patch
AI Analysis

Impact

CyberPanel versions 2.4.3 through 2.4.5 contain unauthenticated AI Scanner debugging endpoints that reveal administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. An attacker who can reach these endpoints can enumerate panel administrators and recent scanner activity, providing valuable reconnaissance for subsequent attacks on a multi‑tenant installation.

Affected Systems

The flaw affects the CyberPanel product by usmannasir, specifically all releases from 2.4.3 up to and including 2.4.5.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. Because the attack can be performed without authentication and the EPSS score is unavailable, the likelihood of exploitation is uncertain but the vulnerability is publicly disclosed, and it is not listed in the CISA KEV catalogue. A likely attack vector is direct HTTP requests to the unprotected AI Scanner debugging endpoints exposed on the panel's web interface.

Generated by OpenCVE AI on September 9, 2026 at 12:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade CyberPanel to version 2.4.6 or later to remove the exposed debugging endpoints.
  • Configure the web server or firewall to block external access to the AI Scanner debug paths, for example by limiting those URLs to localhost or using an access control list.
  • Regularly review server logs for unusual requests to the previously exposed AI Scanner endpoints and investigate any unauthorized activity.

Generated by OpenCVE AI on September 9, 2026 at 12:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Usmannasir
Usmannasir cyberpanel
Vendors & Products Usmannasir
Usmannasir cyberpanel

Wed, 09 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
Title CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
First Time appeared Cyberpanel
Cyberpanel cyberpanel
Weaknesses CWE-200
CPEs cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*
Vendors & Products Cyberpanel
Cyberpanel cyberpanel
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Cyberpanel Cyberpanel
Usmannasir Cyberpanel
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-14T13:09:00.371Z

Reserved: 2026-09-09T10:32:34.110Z

Link: CVE-2026-87820

cve-icon Vulnrichment

Updated: 2026-09-14T13:08:53.971Z

cve-icon NVD

Status : Deferred

Published: 2026-09-09T12:17:17.260

Modified: 2026-09-14T14:17:17.783

Link: CVE-2026-87820

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T21:03:27Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor