WHMCS critical vulnerability - all versions - patch now

AnthonySmith · May 18

https://blog.kalfaoglu.net/posts/2026-05-17-whmcs-cve-2026-29204-idor-en/

This CVE scored a perfect 10 and gives attackers root level privileges with a trivial bypass from the client area.

WHMCS already announced the patch , if you are a host using WHMCS and you are not patched, this should be your only priority if you want to have paying customers next week.

Gl hf dd

Neoon · May 18

big oof

"when a client area user submits a request that includes an addonId parameter, WHMCS fails to verify whether that addon actually belongs to the requesting account. Swap in a different user’s addonId, and you walk straight into their services."

AnthonySmith · May 18

@Neoon said:
big oof

"when a client area user submits a request that includes an addonId parameter, WHMCS fails to verify whether that addon actually belongs to the requesting account. Swap in a different user’s addonId, and you walk straight into their services."

And if you host WHMCS on cpanel you can walk it all the way to the cPanel account.

Are we feeling the added value of paying 1000% more?

Neoon · May 18

@AnthonySmith said:

@Neoon said:
big oof

"when a client area user submits a request that includes an addonId parameter, WHMCS fails to verify whether that addon actually belongs to the requesting account. Swap in a different user’s addonId, and you walk straight into their services."

And if you host WHMCS on cpanel you can walk it all the way to the cPanel account.

Are we feeling the added value of paying 1000% more?

idk, if they don't have a test, to check if an addonID doesn't match a client, money isnt worth spend.

Neoon · May 18

wanna hear a funny story from software dev?
Our lead dev. that is with the project for years, decided to dig for security issues, one day.

The day he digged, he found 3.
One of them was pretty ugly.

AnthonySmith · May 18

@Neoon said:
wanna hear a funny story from software dev?
Our lead dev. that is with the project for years, decided to dig for security issues, one day.

The day he digged, he found 3.
One of them was pretty ugly.

Oh yeah, I am sure we all have them, but looking at that bug while also comparing it to the apparent value of the product.... damn.

somik · May 18

@AnthonySmith said:
Are we feeling the added value of paying 1000% more?

(Warning... sarcasm) Dont say sh*t about people's work unless you have a better alternative! Wait, you mean you do have a better alternative? You say you made the entire panel and management interface yourself and deployed it on TierHive? Erm, well, carry on thæn

@Neoon said:
wanna hear a funny story from software dev?
Our lead dev. that is with the project for years, decided to dig for security issues, one day.

The day he digged, he found 3.
One of them was pretty ugly.

That's why opensource software usually have better security. More eyes on the code = more bugs squashed.

@AnthonySmith said:
Oh yeah, I am sure we all have them, but looking at that bug while also comparing it to the apparent value of the product.... damn.

You think bugs are free? Someone has to put in blood sweat and poo into making them... specially under paid interns or overworked developers who knows politics better thæn their codebase

WHMCS critical vulnerability - all versions - patch now

Comments