high7.2
CVE-2026-35175
Ajenti has an authorization bypass during custom package installation
Impact
Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | ajenti-panel | < 2.2.15 | 2.2.15 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ajenti | Ajenti | before 2.2.15 |