CVE-2026-43643: Softaculous Virtualizor Authorization Bypass via Billing Module Handler

Published Sep 22, 2026
·
Updated

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel dispatcher. Attackers can send a POST request with arbitrary uid and balance values in the billingdata field to trigger an unauthenticated parameterized UPDATE against the users table, enabling account balance manipulation and potential automated service suspension for targeted accounts.

Affected Software

1 affected component
Softaculous Virtualizor<3.2.9 (Patch 9), =3.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Softaculous Virtualizor to a version that resolves this vulnerability.

    Fixed in 3.2.9Patch Patch 9

Event History

Sep 22, 2026
CVE Published
via MITRE·05:54 PM
Data Sourced
via MITRE·05:54 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are affected?

Softaculous Virtualizor versions before 3.2.9 Patch 9 and version 3.0.0 are identified as affected. The vulnerable functionality is the billing module handler reachable through the admin panel dispatcher.

2

What does an attacker need to exploit this issue?

An attacker can exploit the issue remotely without authentication or user interaction. Exploitation involves a crafted POST request using act and from_billing_module parameters, with arbitrary uid and balance values supplied in billing_data.

3

What impact should operators expect from successful exploitation?

An attacker can modify the account balance of any tenant through an unauthorized parameterized UPDATE of the users table. This can potentially trigger automated suspension of targeted accounts.

4

How can I determine whether an instance may have been targeted?

Review requests to the admin panel dispatcher for POSTs containing crafted act and from_billing_module parameters, particularly requests carrying billing_data with unexpected uid or balance values. Investigate unexplained tenant balance changes and automated service suspensions.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203