HestiaCP Authorization Bypass Lets Admins Impersonate Root Users
A high-severity flaw in HestiaCP versions prior to 1.10.5 allows non-root administrators to execute commands as the protected administrator's system account.
Key points
- CVE-2026-111627 affects HestiaCP installations running versions older than 1.10.5.
- The vulnerability is rated 8.6 HIGH on the CVSS scale by the National Vulnerability Database.
- Attackers can bypass read-only restrictions by using the loginas parameter to impersonate the ROOT_USER.
HestiaCP versions before 1.10.5 contain a high-severity authorization bypass flaw. This vulnerability allows non-root administrators to perform write actions while impersonating the protected ROOT_USER account, according to the National Vulnerability Database record for CVE-2026-111627.
What happened
The NVD record for CVE-2026-111627 identifies an authorization bypass vulnerability in HestiaCP. The flaw exists in all versions of the control panel prior to 1.10.5. It allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. The National Vulnerability Database assigns this issue a CVSS score of 8.6, classifying it as HIGH severity.
Attackers exploit this weakness by logging in via the loginas parameter. They then send a POST request to the /add/cron/ endpoint. The application fails to check the read-only flag during this process. This oversight causes the crond service to run the attacker's commands as the protected administrator's system account. The underlying weakness is categorized as CWE-863, which relates to improper authorization checks.
Why it matters
This vulnerability exposes environments where multiple administrators share a HestiaCP instance. Any user with administrative privileges but without root access can escalate their privileges. They can execute arbitrary commands as the protected administrator's system account by manipulating cron jobs. This breaks the principle of least privilege within the control panel.
The impact is significant because the attacker gains the ability to run commands as the protected administrator's system account. They can modify system configurations or install software within the scope of that account. The flaw does not require external exploitation; it leverages existing administrative credentials. This makes insider threats or compromised admin accounts particularly dangerous.
What to watch
- Monitor for unusual cron job creations by non-root administrators.
- Alert on POST requests to /add/cron/ that include the loginas parameter.
- Track command executions running as the protected administrator's system account.
- Review logs for any changes to system crontab files outside normal maintenance windows.
Signals worth monitoring
Security teams should examine web application logs for POST requests targeting the cron addition endpoint. Look for the presence of the loginas parameter in these requests, especially when associated with non-root user sessions. Correlate these web logs with system-level process logs to identify commands executing as the protected administrator's system account. Check for new cron entries that do not match standard administrative patterns. Verify that read-only flags are being respected in the application logic. Investigate any discrepancies between user permissions and the privileges of executed commands.
Background: CVSS score
CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.
Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment
What to do and how to stay safe: HestiaCP
- Audit all HestiaCP installations to confirm they are running version 1.10.5 or later.
- Review cron job logs for entries created by non-root administrators in the past ninety days.
- Restrict access to the /add/cron/ endpoint using web application firewall rules until patched.
- Rotate credentials for all administrative accounts that have accessed the control panel recently.
General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of HestiaCP are affected by CVE-2026-111627?
All versions of HestiaCP prior to 1.10.5 are affected by this authorization bypass vulnerability.
How do attackers exploit this vulnerability?
Attackers use the loginas parameter to impersonate the ROOT_USER and POST to the /add/cron/ endpoint.
What is the CVSS score for this flaw?
The National Vulnerability Database rates CVE-2026-111627 with a CVSS score of 8.6, which is HIGH.
