Read the docs
TI-2026-75413 Aliases CVE-2026-111627GHSA-8hv6-g9hp-x82m

HestiaCP Protected Admin Bypass via Cron Job Creation

Priority HIGH 72CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

HestiaCP before 1.10.5 has an authorization bypass (CWE-863) that lets non-ROOT_USER administrators make write changes while impersonating the protected ROOT_USER account. An attacker with administrator privileges can log in as the protected account through the loginas parameter and submit a cron job, because the read-only flag is never checked, so crond runs the commands as the protected administrator's system account. CVSS 4.0 rates the flaw 8.6 (HIGH) and the record reports a proof-of-concept exploit exists.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00574 47th percentileScored 2026-11-07
Fix Fixed hestiacp (hestiacp): 1.10.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hestiacphestiacpbefore 1.10.51.10.5Patch availableCNA
  • hestiacp Vendorhestiacp Affected before 1.10.5 Fixed in 1.10.5 Patch available CNA

Remediation

Update HestiaCP to version 1.10.5 or later, which is the fixed version. CISA has not listed this flaw in its Known Exploited Vulnerabilities catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA hestiacp (hestiacp) Fixed in 1.10.5

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111627
  2. 2026-10-16 Alias added: GHSA-8hv6-g9hp-x82m
  3. 2026-10-18 CISA SSVC decision points changed
  4. 2026-10-18 Priority changed: MEDIUM → HIGH
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 3

  • TI-2026-31737 HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal CVSS 4.0CRITICAL 9.5
  • TI-2026-31738 HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header CVSS 4.0HIGH 8.7
  • TI-2026-74366 PATH hijacking in HestiaCP lets low-privileged users run code as root CVSS 3.1CRITICAL 9.9
  • TI-2026-10488 HestiaCP Admin Takeover CVSS 4.0HIGH 8.3
  • TI-2023-05375 Privilege Chaining in hestiacp/hestiacp CVSS 3.1HIGH 7.8
  • TI-2022-02355 OS Command Injection in hestiacp/hestiacp CVSS 3.1HIGH 8.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences