{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/hestiacp--1.10.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:hestiacp:hestiacp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-111627"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["HestiaCP (\u003c 1.10.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["HestiaCP"],"content_html":"\u003cp\u003eHestiaCP versions before 1.10.5 are affected by an authorization bypass vulnerability that enables non-ROOT_USER administrators to perform write operations by impersonating the system's protected ROOT_USER account. The vulnerability stems from a flaw in the application's permission logic where the read-only flag is improperly validated when using the 'loginas' parameter. An attacker with administrative access to a sub-account can exploit this by sending a crafted POST request to the '/add/cron/' endpoint. This action causes the underlying 'crond' service to execute the requested commands with the privileges associated with the protected administrative system account, potentially leading to full system compromise. Defenders should prioritize updating to version 1.10.5 or later to remediate this flaw.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains access to a low-privilege administrator sub-account within the HestiaCP control panel.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a request utilizing the 'loginas' parameter to assume the context of the ROOT_USER.\u003c/li\u003e\n\u003cli\u003eAttacker targets the '/add/cron/' API endpoint to initiate a task creation request.\u003c/li\u003e\n\u003cli\u003eThe application fails to validate the read-only restriction for the session context.\u003c/li\u003e\n\u003cli\u003eThe unauthorized write operation is processed, and the cron job is persisted to the system configuration.\u003c/li\u003e\n\u003cli\u003eThe 'crond' daemon schedules the task based on the malicious input.\u003c/li\u003e\n\u003cli\u003eThe system executes the arbitrary command with ROOT_USER privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a restricted administrator to elevate their privileges to the ROOT_USER level and execute arbitrary system commands. This impacts the confidentiality, integrity, and availability of the hosting server, potentially affecting all hosted websites and databases managed by the HestiaCP instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all HestiaCP instances to version 1.10.5 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for suspicious POST requests to the '/add/cron/' endpoint originating from non-root administrative accounts.\u003c/li\u003e\n\u003cli\u003eReview all scheduled cron jobs on HestiaCP servers for unauthorized or unexpected entries created by sub-administrators.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:47:04Z","date_published":"2026-10-16T18:47:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-hestiacp-auth-bypass/","summary":"HestiaCP versions prior to 1.10.5 contain an authorization bypass vulnerability allowing non-privileged administrators to impersonate the ROOT_USER and execute arbitrary cron tasks.","title":"Authorization Bypass in HestiaCP","url":"https://feed.craftedsignal.io/briefs/2026-10-hestiacp-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - HestiaCP (\u003c 1.10.5)","version":"https://jsonfeed.org/version/1.1"}