Jexactyl EUVD-2026-95983

Exploitation requires that billing is enabled on the Jexactyl installation and that the attacker holds a valid authenticated account (PR:L) on that instance. The targeted server must be billable with a renewal_date that is non-null and more than seven days in the future; servers outside this state are not affected. Critically, no subuser or ownership relationship to the victim's server is required - the only knowledge needed is a valid target server_id. Limiting factors: the attack is confined to multi-tenant installations with the free-product billing feature active, the impact is restricted to renewing/unsuspending (no data disclosure or code execution), and all versions 4.0.0 through pre-4.0.5 are affected (fixed in 4.0.5).

This is a moderate, real-but-bounded authorization flaw (CWE-639, IDOR) rather than a critical priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L = 5.4) is internally consistent with the description: network-reachable, low-complexity, and requiring an authenticated but low-privileged account, with no confidentiality loss and only limited integrity/availability impact (renewing or unsuspending another tenant's server). No EPSS score, KEV listing, or SSVC decision data was supplied, so exploitation-probability and automatability cannot be quantified from the input. A vendor patch commit and GitHub Security Advisory (GHSA-9xwv-p7r5-5h5p) are confirmed present, but no public exploit code is referenced - the commit diff is a fix, not a weaponized PoC. The signals are not conflicting: a genuinely authenticated IDOR with low technical impact and no mass-exploitation indicators points to a targeted, opportunistic issue for multi-tenant Jexactyl operators, not a widespread emergency. Note that the impact is primarily cross-tenant state manipulation (unexpected renewal/unsuspension) rather than data theft or code execution.

An attacker registers or already holds a low-privileged account on a Jexactyl installation with billing enabled, then sends a POST to /api/client/billing/free/process supplying another tenant's server_id. Because the endpoint loaded the server via Server::findOrFail without scoping to the caller's owned servers, the attacker can renew or unsuspend a victim's billable server (when its renewal_date is non-null and more than seven days out) without any subuser relationship. No public exploit code is referenced, but the fix commit clearly reveals the vulnerable lookup, making reproduction straightforward.