Permission Assignment Flaw in cPanel Leading to Sensitive Data Exposure
CVE-2026-68490

8.2HIGH

Key Information:

Vendor

Webpros

Status
Cpanel
Vendor
CVE Published:
23 September 2026

What is CVE-2026-68490?

A vulnerability in cPanel's permission settings allows local users to access sensitive CalDAV and CardDAV information from other user accounts. This flaw stems from incorrect permission assignment, which can lead to unauthorized access to sensitive data, posing a significant risk to user privacy and security. Users should review their configurations and consider necessary updates to mitigate potential data exposure.

Affected Version(s)

cPanel 11.120.0.0 < 11.134.0.57

cPanel 11.136.0.0 < 11.136.0.41

cPanel 11.138.0.0 < 11.138.0.8

References

https://support.cpanel.net/hc/en-us/articles/43502940099991

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ali Mustafa (rz1027)
.