CVE-2024-27288 1Panel open source panel project has an unauthorized vulnerability.

What is CVE-2024-27288?

CVE-2024-27288 is a medium-severity missing authorization vulnerability in 1Panel-dev 1Panel, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.

Weakness: CWE-863

Which versions are affected by CVE-2024-27288?

3 open source packages ship an affected version, including github.com/1Panel-dev/1Panel. It affects 1 product.

Products include Fit2cloud 1panel.

How do I fix CVE-2024-27288?

Upgrade github.com/1Panel-dev/1Panel to 1.10.1-lts or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-27288 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27288 exists.

Other vulnerabilities in 1Panel-dev 1Panel

• CVE-2024-39911 1Panel SQL injection Critical 10.0
• CVE-2024-39907 a sqlinjection in 1Panel Critical 9.8
• CVE-2025-56413 Command injection in n/a High 8.8
• CVE-2025-54424 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution High 8.1
• CVE-2025-66507 1Panel – CAPTCHA Bypass via Client-Controlled Flag High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-26w3-q4j8-4xjp, GO-2024-2613.