CVE-2026-43643 json
Softaculous Virtualizor Authorization Bypass via Billing Module Handler
published 2026-09-22 47 d ago modified 2026-10-01 38 d ago also EUVD-2026-84624
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and from_billing_module parameters to the admin panel dispatcher. Attackers can send a POST request with arbitrary uid and balance values in the billing_data field to trigger an unauthenticated parameterized UPDATE against the users table, enabling account balance manipulation and potential automated service suspension for targeted accounts.
Patch / fix
- Softaculous Virtualizor 3.0.0, 3.2.9 (Patch 9)
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 47 d ago
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- vulncheck.com https://www.vulncheck.com/blog/virtualizor-billing-hook-unauthenticated-root-rce referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Softaculous Virtualizor
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
virtualizor.com
/blog/virtualizor-3-2-9-launched-release-candidate-patch-9/
release-notes, patch
-
virtualizor.com
/blog/virtualizor-3-3-0/
release-notes, patch
-
vulncheck.com
/blog/virtualizor-billing-hook-unauthenticated-root-rce
technical-description, exploit
-
vulncheck.com
/advisories/softaculous-virtualizor-authorization-bypass-via-billing-module-handler
third-party-advisory
Sources
- CVE List CVE-2026-43643
- NVD CVE-2026-43643
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.