HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while… (CVE-2026-111627)

CVE-2026-111627 describes an authorization bypass vulnerability in HestiaCP prior to version 1.10.5. The flaw allows non-ROOT_USER administrators to escalate privileges by impersonating the ROOT_USER account. Specifically, attackers can exploit the loginas parameter and submit POST requests to the /add/cron/ endpoint. Due to the read-only flag not being enforced, the system executes attacker-supplied commands as the protected ROOT_USER system account, leading to full control over cron jobs.

Successful exploitation results in high impact, including full confidentiality, integrity, and availability compromise. Attackers gain the ability to execute arbitrary commands as the protected ROOT_USER system account, effectively allowing complete system control under the privileged administrator context.

A fix is available in HestiaCP version 1.10.5. Users should upgrade to version 1.10.5 or later to remediate this authorization bypass vulnerability. No other mitigation guidance is provided or necessary once patched.