CVE-2026-87820: Exposure of Sensitive Information to an Unauthorized Actor in usmannasir cyberpanel
Affects usmannasir cyberpanelSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 58% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| usmannasircyberpanel | Affected
| Fixed in
|
GitHub Actionsusmannasir/cyberpanelpkg:github/usmannasir/cyberpanelOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until an official fix is available, restrict access to debugging endpoints and monitor for unauthorized access attempts. Avoid exposing CyberPanel interfaces to untrusted networks.
Description
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
Impact
The exposure of sensitive information to unauthenticated actors can lead to enumeration of administrator accounts and recent scanning activities. This information disclosure increases the risk of targeted attacks against CyberPanel installations, especially in multi-tenant environments. However, there is no indication of direct code execution or privilege escalation from this vulnerability alone.
Summary
CVE-2026-87820 affects CyberPanel versions 2.4.3 through 2.4.5 by exposing unauthenticated AI Scanner debugging endpoints. These endpoints disclose sensitive information including administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. The vulnerability enables unauthenticated attackers to enumerate administrators and scanner activity, which can be leveraged to profile multi-tenant environments and facilitate follow-on attacks.
References
- github.com/usmannasir/cyberpanel/security/advisories/GHSA-qmwq-9cc8-x6h2 (opens in a new tab)
- github.com/usmannasir/cyberpanel/commit/20484fd1786a424054386e5d6290d66b47cab3a3 (opens in a new tab)
- vulncheck.com/advisories/cyberpanel-2.4.3-through-2.4.5-information-disclosure-via-ai-scanner (opens in a new tab)