HestiaCP Unauthenticated RCE via Defective Privilege Check and Account Takeover (CVE-2026-12196)

Vulnerability Overview HestiaCP allows low-privilege users to create their own cron jobs, which by default enable code execution. The privilege model is designed around each web panel user, corresponding to a Linux user, and enforces file system access and process isolation at the operating system level. Any cron jobs created by low-privilege users are executed under the same low-privilege Linux user. The control panel itself runs under a higher-privilege account that has passwordless access to several administrative scripts of the management system. "Panel cron jobs" can only be created or modified by administrators and are executed with the elevated panel user privileges. Authorization code intended to prevent low-privilege users from modifying "panel cron jobs" is implemented as an statement that redirects users. However, this statement contains a flaw because is undefined, causing the statement to always evaluate to false, and thus unauthenticated users are not redirected. Impact Low-privilege users can take over other user accounts by invoking maintenance scripts to change any user's password. The specific exploitation method is: Remediation The fix can be found via the following Pull Request: Fix if statement by sashanu - Pull Request #5440 · hestiacp/hestiacp. This fix needs to be applied manually until HestiaCP decides to release an update. Proof of Concept Code Additional Information This vulnerability is tracked as CVE-2026-12196. A GitHub link is provided at the bottom of the page, pointing to the Pull Request that fixes this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

HestiaCP Unauthenticated RCE via Defective Privilege Check and Account Takeover (CVE-2026-12196)