CVE-2026-35175
Ajenti is a Linux and BSD modular server admin panel.
Published Apr 6, 2026 · updated Jul 24, 2026 · ajenti ajenti
Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 6, 2026 · NIST NVD
Detected
Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15.
Jul 24, 2026 · NIST NVD
Updated
Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15.
Affected
- cpe ajenti/ajentiversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-35175
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-35175
Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15.
nvd.nist.gov