Insufficient authorization in WHMCS Client Area addon handling (CVE-2026-29204)

An authenticated WHMCS Client Area user can submit requests referencing another user's addon ID without any ownership validation in `clientarea.php`. This allows an attacker with a valid session to perform actions in the context of another user's account, including accessing services they do not own. Affected versions: - All WHMCS 9.x builds prior to 9.0.4 - All WHMCS 8.x builds prior to 8.13.3 - All WHMCS 7.x builds after 7.4.0 We recommend updating to: WHMCS 9.0.4, WHMCS 8.13.3. CVSS 9.1 · our assessment: act_now Reference: https://help.whmcs.com/m/125386/l/2073908-cve-2026-29204?token=_4RH-0s0febHsrNiC8GdPymsqg3_nSdT Details: https://vuln.today/cve/CVE-2026-29204