{"id":"CVE-2026-111627","revision":"fb8f3846326b48c3a84c1e9d4b89f6e9","records":[{"revision":"fb8f3846326b48c3a84c1e9d4b89f6e9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-111627","aliases":[],"title":"HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation","description":"HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.","state":0,"publishedAt":"2026-10-16T17:39:02.155+00:00","modifiedAt":"2026-10-16T19:32:00.506+00:00","affected":[{"ecosystem":"Vendor product","name":"hestiacp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"hestiacp\",\n                    \"product\": \"hestiacp\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.10.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:github/hestiacp/hestiacp\",\n                    \"repo\": \"https://github.com/hestiacp/hestiacp\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.6,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2,"severity":"HIGH"}],"references":["https://github.com/hestiacp/hestiacp/security/advisories/GHSA-vp7q-fjv5-5vg8","https://github.com/hestiacp/hestiacp/blob/1.10.4/web/add/cron/index.php#L11-L70","https://github.com/hestiacp/hestiacp/blob/1.10.4/web/inc/policies.php#L3-L14","https://github.com/hestiacp/hestiacp/commit/1af7e057cd5ad2ea945acba6c9932ea1a1802c24","https://github.com/hestiacp/hestiacp/releases/tag/1.10.5","https://www.vulncheck.com/advisories/hestiacp-before-1.10.5-protected-admin-bypass-via-cron-job-creation"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111627","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111627","identifiers":["CVE-2026-111627"]},"retained":false,"historicalAffected":[]}],"coverage":[]}