—
PYSEC-2026-2339
Ajenti has an authorization bypass during custom package installation
Quick fix
PYSEC-2026-2339 — ajenti-panel: upgrade to the fixed version with the command below.
pip install --upgrade 'ajenti-panel>=2.2.15'Details
### Impact
An authenticated user (using the `auth_users` plugin authentication method) could install a custom package even if this user is not superuser.
### Patches
This is fixed in the version 2.2.15. Users should upgrade to this version as soon as possible.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/ajenti/ajenti/security/advisories/GHSA-73jv-44c3-j5p2[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-35175[ADVISORY]
- https://github.com/ajenti/ajenti[PACKAGE]
- https://github.com/ajenti/ajenti/releases/tag/v2.2.15[WEB]
- https://pypi.org/project/ajenti-panel[PACKAGE]
- https://github.com/advisories/GHSA-73jv-44c3-j5p2[ADVISORY]