HestiaCP: Authorization bypass allows protected admin impersonation via cron jobs

Summary

HestiaCP before 1.10.5 contains an authorization bypass in the cron job creation endpoint. A non-root administrator who logs in via the loginas parameter can POST to /add/cron/, because the read-only flag for the protected ROOT_USER account is not checked. Cron commands then run as the protected administrator's system account. An attacker needs an existing admin login on the panel, so the flaw is not exploitable without prior authentication.

Affected

• HestiaCP versions before 1.10.5 (affected range 0 to < 1.10.5 according to the CVE record)

Fixed in

• Fixed in HestiaCP 1.10.5
• Vendor advisory: GHSA-vp7q-fjv5-5vg8 (patched-version statement not verified)

Workaround

• Unknown.
• Interim measure: restrict admin accounts on the panel to trusted persons only.

Exploitation

• No confirmed exploitation in the wild found.
• CISA SSVC data in the CVE record lists exploitation as PoC, automatable as no.
• A public proof-of-concept reference is tagged in third-party records; its content was not verified.
• Not listed in CISA KEV (per Strix).

Our recommendation

• Upgrade HestiaCP to version 1.10.5 or later in the next maintenance window.
• Review admin accounts and remove any that are not needed.
• Check existing cron jobs on affected servers for unexpected entries, especially those running under the root user's system account.
• Monitor panel logs for logins via loginas and POST requests to /add/cron/.
• Note: CVSS 4.0 rates this 8.6 (High), while the vendor rates it Moderate; prioritise according to how many people hold admin roles.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-vp7q-fjv5-5vg8 github.com
• HestiaCP 1.10.5 release github.com
• Fix commit 1af7e057 github.com
• VulnCheck advisory www.vulncheck.com
• Vulnerable cron controller at 1.10.4 github.com
• Vulnerable policy logic at 1.10.4 github.com
• HestiaCP security policy github.com
• OpenCVE record CVE-2026-111627 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:52.