Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-35175

Ajenti has an authorization bypass during custom package installation

Description

Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ajenti ajenti

  • < 2.2.15affected

References