CVE-2026-107854: Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)
Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations with billing enabled, an authenticated user can renew or unsuspend another tenant's billable server when its renewaldate is non-null and more than seven days away, even without a subuser relationship to that server. This issue is fixed in version 4.0.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jexactylto a version that resolves this vulnerability.Fixed in 4.0.5
Event History
Frequently Asked Questions
Which deployments are exposed?
Jexactyl installations running versions 4.0.0 through 4.0.5 with billing enabled are affected. The issue concerns billable servers whose renewal_date is non-null and more than seven days away.
What does an attacker need to exploit this?
An attacker needs an authenticated Jexactyl client account and the ID of another tenant's eligible server. They do not need a subuser relationship to the target server.
What can an attacker do?
The attacker can cause another tenant's billable server to be renewed or unsuspended. The vulnerability does not provide access to the target server's contents or ownership.
How should this be remediated?
Upgrade to Jexactyl version 4.0.5, which fixes the missing ownership check. If immediate patching is not possible, restrict access to the affected billing functionality where feasible and monitor requests to the free-billing process endpoint.