Insufficient Ownership Checks in WHMCS Affecting User Resources

CVE-2026-29204

What is CVE-2026-29204?

The WHMCS Client Area is susceptible to a security flaw where inadequate ownership checks allow authenticated users to exploit clientarea.php. This vulnerability enables an attacker to submit requests using another user's addonId, bypassing proper ownership validation. Consequently, this can lead to unauthorized access to sensitive resources and data within a victim's cPanel account, posing a significant security risk for WHMCS users. Immediate attention to this issue is essential to safeguard user accounts and prevent potential exploitation.

References