CVE-2026-35175 — Ajenti has an authorization bypass during custom package installation
Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package e…
Published: 2026-04-06 · CVSS: 7.2 · CVSS 4.0
Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7