CVE-2026-12196

HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts HestiaCP management scripts with passwordless sudo. This could result in the takeover of administrator users in the application and the underlying webserver.

CVSS

No CVSS.

References

Link	Resource
https://github.com/hestiacp/hestiacp/pull/5440
https://projectblack.io/blog/hestiacp-admin-takeover-rce/

Configurations

No configuration.

History

04 Jul 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-04 12:16

Updated : 2026-07-06 19:43

NVD link : CVE-2026-12196

Mitre link : CVE-2026-12196

CVE.ORG link : CVE-2026-12196

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-12196", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12196", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T13:57:14.611592Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a", "affectedData": [{"vendor": "hestiacp", "product": "hestiacp", "versions": [{"status": "affected", "version": "0", "lessThan": "8be23943c7e3231f66d226ca931c76f93be98412", "versionType": "git"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-04T12:16:53.600", "references": [{"url": "https://github.com/hestiacp/hestiacp/pull/5440", "source": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a"}, {"url": "https://projectblack.io/blog/hestiacp-admin-takeover-rce/", "source": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts HestiaCP management scripts with passwordless sudo. This could result in the takeover of administrator users in the application and the underlying webserver."}], "lastModified": "2026-07-06T19:43:54.290", "sourceIdentifier": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a"}

CVE-2026-12196

JSON object

Attach tags to CVE-2026-12196

Attach tags to `CVE-2026-12196`