Description
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| usmannasir | cyberpanel | 2.4.3 – < 2.4.6 | 2.4.6 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- CyberPanel 2.4.3-2.4.5 - AI Scanner Debug Disclosure http/cves/2026/CVE-2026-87820.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2026-2793 CyberPanel: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Sep 9, 2026
References
- GitHub Security Advisory (GHSA-qmwq-9cc8-x6h2) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner third-party-advisory