CVE-2026-29811

Improper alias domain detection using ORM filter instead of conditional check.

• CVSS 7.7
• 1025
• Design Defects
• Remote

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

CVE

CVE-2026-29811

CWE

1025

CVSS base score

7.7

Published

2026-09-13

OWASP

A04 Insecure Design

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Design Defects

Subcategory

Poorly Designed Access Controls

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

CyberPanel

Solution

Upgrade CyberPanel to version 2.4.4 or later.

from django.db import models

class Domain(models.Model):
    name = models.CharField(max_length=255)
    is_primary = models.BooleanField(default=False)

def get_content_domain(request):
    host = request.get_host()
    # VULNERABLE: using ORM filter for alias detection enables bypass
    alias = Domain.objects.filter(alais=host).first()
    if alias:
        return alias
    primary = Domain.objects.filter(name=host, is_primary=True).first()
    return primary

from django.db import models

class Domain(models.Model):
    name = models.CharField(max_length=255)
    is_primary = models.BooleanField(default=False)

def get_content_domain(request):
    host = request.get_host()
    # FIX: perform explicit Python check for alias instead of ORM filter
    alias = Domain.objects.filter(name=host, is_primary=False).first()
    if alias and alias.name == host:
        return alias
    primary = Domain.objects.filter(name=host, is_primary=True).first()
    return primary

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202629811,
  title        = {{Improper alias domain detection using ORM filter instead of conditional check.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-29811},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-29811/}}
}