Authorization bypass through user-controlled key in Hestia Control Panel - #VU146001
Published: August 27, 2026
Vulnerability identifier: #VU146001
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the backup restore flow when handling restore requests for backup archives. A remote user can submit a restore request referencing another user\'s backup archive to disclose sensitive information.
Exploitation requires a valid authenticated panel session, a local backup archive for another user in the shared backup directory, and knowledge or guessing of the target archive name.
Affected software
Hestia Control Panel
Remediation
Install security update from vendor's website.
Hestia Control Panel - addressed in versions 1.9.10, 1.10.4