CVE-2026-56843

CriticalCVSS 9.9/10Last modified Oct 25, 2026

Description

Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be leveraged to execute code as another tenant's system user.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-568448.4A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and CVE-2026-568457.5An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By CVE-2026-568467.5A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. Thi CVE-2026-568476.1A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. CVE-2026-568487.5A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is execut CVE-2026-56858.8A vulnerability was identified in Tenda CX12L 16.03.53.12. This affects the function fromAddressNat of the file /goform/addressNat. The mani CVE-2026-568504.4A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be CVE-2026-568517.5The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.CVE-2026-568527.5A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.CVE-2026-568537.5When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 c CVE-2026-568547.5The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and CVE-2026-568557.5Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. No