CVE-2026-43643: Softaculous Virtualizor Authorization Bypass via Billing Module Handler
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel dispatcher. Attackers can send a POST request with arbitrary uid and balance values in the billingdata field to trigger an unauthenticated parameterized UPDATE against the users table, enabling account balance manipulation and potential automated service suspension for targeted accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Softaculous Virtualizorto a version that resolves this vulnerability.Fixed in 3.2.9Patch Patch 9
Event History
Frequently Asked Questions
Which deployments are affected?
Softaculous Virtualizor versions before 3.2.9 Patch 9 and version 3.0.0 are identified as affected. The vulnerable functionality is the billing module handler reachable through the admin panel dispatcher.
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely without authentication or user interaction. Exploitation involves a crafted POST request using act and from_billing_module parameters, with arbitrary uid and balance values supplied in billing_data.
What impact should operators expect from successful exploitation?
An attacker can modify the account balance of any tenant through an unauthorized parameterized UPDATE of the users table. This can potentially trigger automated suspension of targeted accounts.
How can I determine whether an instance may have been targeted?
Review requests to the admin panel dispatcher for POSTs containing crafted act and from_billing_module parameters, particularly requests carrying billing_data with unexpected uid or balance values. Investigate unexplained tenant balance changes and automated service suspensions.