CVE-2026-43643
Softaculous Virtualizor Authorization Bypass via Billing Module Handler
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 22, 2026
- Updated
- Oct 1, 2026
- Reserved
- May 1, 2026
Description
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and from_billing_module parameters to the admin panel dispatcher. Attackers can send a POST request with arbitrary uid and balance values in the billing_data field to trigger an unauthenticated parameterized UPDATE against the users table, enabling account balance manipulation and potential automated service suspension for targeted accounts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
VirtualizorSoftaculous |
|
References
- VulnCheck Blogtechnical-descriptionexploit
- 3.2.9 Patch 9 Release Notesrelease-notespatch
- 3.3.0 Release Notesrelease-notespatch
- https://www.vulncheck.com/advisories/softaculous-virtualizor-authorization-bypass-via-billing-module-handlerthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.