CVE-2026-32991

HighCVSS 7.1/10Last modified Oct 26, 2026

Description

Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
WebPros	cPanel	>= 11.136.0.0, < 11.136.0.10; >= 11.134.0.0, < 11.134.0.26; >= 11.132.0.0, < 11.132.0.32; >= 11.130.0.0, < 11.130.0.23; >= 11.126.0.0, < 11.126.0.59; >= 11.124.0.0, < 11.124.0.38; >= 11.118.0.0, < 11.118.0.67; >= 11.110.0.0, < 11.110.0.119
WebPros	WP Squared	>= 11.136.1.0, < 11.136.1.12
WebPros	cPanel (CloudLinux 6, CentOS 6)	>= 11.110.0.0, < 11.110.0.118

References

https://support.cpanel.net/hc/en-us/articles/40437254183959-Security-CVE-2026-32991-cPanel-WHM-WP2-Security-Update-May-13-2026

Timeline

Published: May 13, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-329928.2SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture CVE-2026-329938.3Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject ar CVE-2026-329945.3The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows CVE-2026-329957.5The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 CVE-2026-329967.3This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.CVE-2026-329978.6A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Rep CVE-2026-329989.4This vulnerability in Veeam Service Provider Console allows for remote code execution.CVE-2026-329999.0Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute CVE-2026-33009.8The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and includin CVE-2026-330009.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS CVE-2026-330018.8Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives,CVE-2026-330027.5Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made t