New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts
cPanel patched a root privilege escalation and cross-tenant flaws in calendars, contacts, and WordPress databases.
cPanel's September 22, 2026 release fixes three tenant-isolation flaws in cPanel and WHM 120 and later. CVE-2026-68490 is an incorrect-permissions bug in CalDAV and CardDAV that lets a local user read, but not modify, other accounts' calendars and contacts. CVE-2026-87899 lets any authenticated cPanel user execute code as root, and CVE-2026-87900 in WP Toolkit through 6.11.2-10794 lets a user alter other accounts' databases. Fixed builds are 11.134.0.57, 11.136.0.41, 11.138.0.8, WP Squared 11.138.1.11 or newer, and WP Toolkit 6.11.3 or later; no exploitation is reported.
- CVE-2026-68490 lets a local user read other accounts' calendars and contacts.
- CVE-2026-87899 lets any authenticated cPanel user execute code as root.
- CVE-2026-87900 lets a user modify databases owned by other WP Toolkit accounts.
- Fixes are cPanel/WHM 11.134.0.57, 11.136.0.41, 11.138.0.8 and WP Squared 11.138.1.11+.
- WP Toolkit must be upgraded separately to version 6.11.3 or later.
- Vendors
- cPanelLiteSpeedConfigServer
- Organizations
- cPanel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65638 | Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF) | 9.2 | — | ||
| CVE-2026-65643 | Authenticated eval injection in cPanel enables root code execution | 8.7 | <1% | ||
| CVE-2026-67401 | Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE | 9.9 | <1% | PoC ×5 | |
| CVE-2026-68490 | CalDAV/CardDAV Permission Flaw in cPanel Lets Local Users Read Other Accounts' Data | 8.2 | — | ||
| CVE-2026-87899 | Authenticated Privilege Escalation to Root RCE in cPanel & WHM | 9.4 | — | ||
| CVE-2026-87900 | Argument Injection in WP Toolkit for cPanel Allows Cross-Account File Read and RCE | 9.4 | — |
From the original article
3 min read at cybersecuritynews.com
cPanel has patched three newly disclosed security vulnerabilities that threaten tenant isolation on shared-hosting servers, including a permissions flaw that exposes other users’ calendars and contacts.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.