CVE-2026-54728 Details

A vulnerability allowing authenticated privilege escalation has been identified in BunkerWeb versions prior to 1.6.12 and BunkerWeb PRO versions prior to 0.57. The issue arises from improper validation of user-controlled input in the Host header, which can be exploited by low-privileged authenticated users to inject crafted headers. This injection affects the Biscuit authentication token generation, potentially allowing the attacker to escalate privileges, including obtaining administrative rights. The vulnerability is only exploitable when the BunkerWeb UI and API are directly exposed without proper protection, such as through a reverse proxy that validates virtual hosts.

Users should upgrade to BunkerWeb version 1.6.12 or BunkerWeb PRO version 0.57. After upgrading, it is recommended to invalidate existing sessions or authentication tokens for low-privileged users if there is a suspicion that the vulnerable configuration was exposed.