New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts

cPanel has patched three newly disclosed security vulnerabilities that threaten tenant isolation on shared-hosting servers, including a permissions flaw that exposes other users’ calendars and contacts.

The September 22, 2026, security release addresses CVE-2026-68490 alongside a root privilege-escalation bug and a WP Toolkit cross-account database vulnerability, making immediate updates essential for hosting providers and server administrators.

cPanel Vulnerability

Tracked as CVE-2026-68490, the primary vulnerability stems from incorrect permissions in cPanel’s CalDAV and CardDAV functionality. A local user with access to the same server could exploit the weakness to read calendar events and contact information belonging to other cPanel accounts.

The flaw breaks a key security boundary in multi-tenant environments, where customers expect their account data to remain isolated.

Exploitation is limited to reading exposed records: the attacker cannot modify calendars or address books through this flaw, and successful abuse does not provide root access.

Nevertheless, leaked appointments and contact details may reveal names, email addresses, business relationships, meeting schedules, or other information useful for phishing and social-engineering attacks. Security researcher Ali Mustafa, known as rz1027, responsibly disclosed the issue to cPanel.

For shared hosts, even read-only exposure is significant because one legitimate tenant could collect private information from unrelated customers without permission.

According to the security advisory published by cPanel, CVE-2026-68490 affects cPanel and WHM versions 120 and later. Fixed builds are 11.134.0.57, 11.136.0.41, 11.138.0.8, and WP Squared 11.138.1.11 or newer.

Applying the update corrects permissions for newly created calendar and address-book storage while repairing unsafe permissions on existing accounts.

The same release fixes CVE-2026-87899, a substantially more dangerous vulnerability in CalDAV and CardDAV. Any authenticated cPanel account holder could escalate privileges

and execute code as root, potentially gaining complete control of the underlying server. It affects version 120 and later and is resolved by the same cPanel, WHM, and WP Squared builds listed for CVE-2026-68490.

CVE-2026-87900 affects database-creation command handling in WP Toolkit. A logged-in cPanel user could modify databases owned by other accounts, creating a serious cross-tenant integrity risk for WordPress hosting.

WP Toolkit 6.11.2-10794 and earlier are vulnerable; administrators must upgrade the separately packaged wp-toolkit-cpanel component to version 6.11.3 or later.

Administrators should update cPanel and WHM through “Home / cPanel / Upgrade to Latest Version” in WHM or run /usr/local/cpanel/scripts/upcp –force as root. WP Toolkit requires its own upgrade to 6.11.3 or later.

Teams should verify installed versions after deployment and examine account, database, calendar, and address-book activity for unexplained cross-user access.

Providers should prioritize public, multi-user systems and confirm that automatic update policies have not left individual nodes behind.

The disclosures continue a notable run of cPanel ecosystem flaws. Recent Cyber Security News coverage includes CVE-2026-65638, an unauthenticated command-injection issue in ConfigServer Security & Firewall’s optional MESSENGER service; CVE-2026-67401, an EmailTrack SQL injection leading to root code execution; and CVE-2026-65643, a domain-parking flaw allowing authenticated users to create arbitrary files and obtain root control.

A separate LiteSpeed Enterprise vulnerability affecting versions before 6.3.7 could let low-privileged shared-hosting users bypass tenant isolation and gain root access.

The vulnerabilities covered are CVE-2026-68490, CVE-2026-87899, CVE-2026-87900, CVE-2026-65638, CVE-2026-67401, CVE-2026-65643, and the LiteSpeed Enterprise flaw fixed in version 6.3.7.

Prompt patching is critical because a single compromised hosting account can expose neighboring tenants or, in the most severe cases, the entire server.

The post New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts appeared first on Cyber Security News.