cPanel EUVD-2026-30205

The attacker must already hold valid credentials for a cPanel/WP Squared Team Manager sub-user account on the target server (PR:L), so the deployment must have the Team Manager feature in use with at least one delegated team-member account - single-owner cPanel accounts with no team members are not exploitable. The attack is network-reachable over the standard cPanel/WHM web interface with low complexity and no user interaction (AV:N/AC:L/UI:N), and is bounded by the affected version ranges listed in the EUVD data (e.g., cPanel 11.136.0.0 prior to 11.136.0.10, WP Squared 11.136.1.0 prior to 11.136.1.12, and earlier maintenance branches down to the CloudLinux 6 / CentOS 6 legacy build). The scope is unchanged (S:U) and impact is limited to the single hosting account whose team the attacker belongs to, not the entire WHM server.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) indicates a network-reachable, low-complexity attack requiring only low-level authenticated access and no user interaction, with high integrity impact - consistent with a privilege-escalation primitive rather than a remote takeover. Real-world exploitation signals are muted: EPSS is 0.03% (7th percentile), CISA SSVC scores Exploitation as 'none' and Automatable as 'no' with only 'partial' technical impact, and the vulnerability is not in the CISA KEV catalog. The contrast between the high CVSS integrity rating and the very low EPSS/SSVC signals suggests this is a real but narrowly scoped insider-threat issue: any environment that grants Team Manager access to less-trusted parties (resellers, contractors, junior staff) should treat it as a priority, while single-tenant cPanel installations with no team members face minimal exposure.

A reseller, contractor, or junior staffer who has been granted a low-privilege Team Manager sub-account in cPanel sends a crafted authenticated request to a team-privilege endpoint that fails to validate that the caller is not attempting to act as the team owner. The authorization check evaluates the wrong subject, the request succeeds, and the team member gains owner-equivalent control of the hosting account - enabling them to read all hosted site data, modify other team members, or deploy malicious content. No public exploit has been identified at time of analysis.