CVE-2026-56843

9.9 Critique

Publiée le 08/07/2026 à 03:16 · Modifiée le 10/07/2026 à 20:57 · Analyse NVD reportée · Source : support@hackerone.com

Description

Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be leveraged to execute code as another tenant's system user.

Traduire en français

Produits concernés

Webpros Plesk

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.9 Critique	support@hackerone.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-522

Références

https://support.plesk.com/hc/en-us/articles/41178305151255-Vulnerability-in-Plesk-XML-API-Cleartext-FTP-Password-Exposure

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories