PT-2026-40319 · Whmcs · Whmcs

Published 2026-05-12 · Updated 2026-05-21 · CVE-2026-29204

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WHMCS versions 7.4 through 8.13.2 WHMCS versions 9.0 through 9.0.3

Description Insufficient ownership checks in the 'clientarea.php' endpoint allow an authenticated client area user to submit requests using another user's addonId without ownership validation. This leads to unauthorized access to the victim's resources and their cPanel account.

Recommendations Update to version 8.13.3. Update to version 9.0.4.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-29204

Affected Products

Whmcs

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-29204 · Security Note
• https://help.whmcs.com/m/125386/l/2073908-cve-2026-29204?token=_4RH-0s0febHsrNiC8GdPymsqg3_nSdT · Note
• https://twitter.com/Linuxmaster14/status/2054824453519847743 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2054267873703399605 · Twitter Post
• https://hostpedia.ro/news/cve-2026-29204-whmcs-idor-client-area · Reddit Post
• https://reddit.com/r/WHMCS/comments/1tfg7wf/cve202629204_whmcss_idor_bug_scores_a_perfect_10 · Reddit Post
• https://twitter.com/CVEnew/status/2054340973887385742 · Twitter Post
• https://help.whmcs.com/m/125386/l/2073908-cve-2026-29204 · Note
• https://reddit.com/r/webhosting/comments/1tg20y6/cve202629204_whmcss_idor_bug_scores_a_perfect_10 · Reddit Post
• https://t.me/cveNotify/163305 · Telegram Post
• https://reddit.com/r/WHMCS/comments/1tban4m/important_whmcs_security_release_scheduled_for · Reddit Post