What is the CVSS score of CVE-2026-29204?

CVE-2026-29204 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of WHMCS are affected by CVE-2026-29204?

WHMCS authentication controls contain a flaw that allows logged-in customers to view and access addon services and cPanel accounts belonging to other customers by manipulating input parameters,…. A patch is available.

How to fix or mitigate CVE-2026-29204?

Within 24 hours, inventory all WHMCS installations and identify which are running affected versions (7.4.0-8.12.2, 8.13.0-8.13.2, 9.0.0-9.0.3) and assess customer-facing exposure. Within 7 days, apply the vendor-released patch immediately to all affected WHMCS installations, prioritizing production environments, and coordinate with hosting operations to validate patching in staging before production rollout. Within 30 days, conduct a post-patch audit of customer account access logs for the vulnerability's indicators (direct addonId parameter tampering) and notify affected customers if evidence of unauthorized access is discovered.

WHMCS CVE-2026-29204

EUVD-2026-29551 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-12 support@hackerone.com

GHSA-5j8p-mmp9-6fj8

PHP Authentication Bypass

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Authenticated client area login is required per the description, so PR:L not PR:N; network-reachable web request with low complexity, high confidentiality and integrity impact from cross-account resource and cPanel access, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:19 vuln.today

CVSS changed

May 12, 2026 - 22:22 NVD

10.0 (CRITICAL) 9.1 (CRITICAL)

Patch available

May 12, 2026 - 19:02 EUVD

CVE Published

May 12, 2026 - 18:16 nvd

CRITICAL 10.0

CVE Published

May 12, 2026 - 18:16 cve.org

CRITICAL 9.1

DescriptionCVE.org

Insufficient ownership checks in clientarea.php allow an authenticated client area user to submit requests using another user’s addonId without any ownership validation leading to unauthorized access to the victim's resources and their cPanel account.

AnalysisAI

Insecure Direct Object Reference (IDOR) in WHMCS lets a logged-in client area user access another customer's addon services and linked cPanel account by supplying a victim's addonId to clientarea.php, which never validates resource ownership. Affected releases span WHMCS 7.4.0 through 8.12.2, 8.13.0 before 8.13.3, and 9.0.0 before 9.0.4; a vendor patch is available. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and it is not on CISA KEV.

Technical ContextAI

WHMCS is a widely deployed commercial client-management, billing, and automation platform for web-hosting providers, which routinely provisions and links downstream cPanel/WHM accounts. The flaw is CWE-639 (Authorization Bypass Through User-Controlled Key): the clientarea.php endpoint accepts an addonId parameter identifying a purchased addon/service but performs no check that the requesting authenticated session actually owns that object. Because addon identifiers are sequential/guessable server-side references, any client can pivot to arbitrary customers' addon resources - and, since those resources map to provisioned hosting, to the associated cPanel accounts.

RemediationAI

Patch available per vendor advisory: upgrade to WHMCS 9.0.4 (for the 9.0.x branch) or 8.13.3 (for the 8.13.x branch); installations on 7.4.0-8.12.2 should upgrade to a fixed maintenance release (8.13.3 or later per the vendor guidance at https://help.whmcs.com/m/125386/l/2073908-cve-2026-29204). Because exploitation only requires a valid low-privilege client login, apply the update promptly on any internet-facing portal. As interim compensating controls until patching, restrict or gate self-service client registration to reduce the pool of attacker-usable accounts, monitor clientarea.php access logs for enumeration of sequential addonId values and anomalous cross-account access, and place the client area behind additional access controls (WAF rules flagging addonId parameter tampering or IP allow-listing for staff-managed portals) - noting these do not fix the underlying missing ownership check and may impede legitimate customers if too aggressive.