Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-29204

Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation leading

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation leading to unauthorized access to the victim's account.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WebPros WHMCS

Default version status: unaffected

  • 7.4.0 to ≤ 18.12.2affected
  • 18.13.0 to < 18.13.3affected
  • 9.0.0 to < 9.0.4affected

References