CVE Intelligence
Analysis AI-assisted

CVE-2026-29204: WHMCS Authorization Bypass via addonId in Client Area

WebPros WHMCS does not verify ownership of the addonId value submitted to clientarea.php, so an authenticated client area user can reference another user's add-on. The record describes this as leading to unauthorized access to the victim's account and rates it critical (CVSS 3.1 score 9.1 from the CNA). No confirmed exploitation appears in the sources consulted, and the referenced WHMCS help page is the main source for remediation details.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-29204 is an insufficient ownership check in the client area of WHMCS, specifically in the clientarea.php handler. The weakness is classified as CWE-639, an authorization bypass through a user-controlled key (IDOR). According to the record, an authenticated client area user can submit requests that reference another user's addonId without any ownership validation.

Impact

  • The record states that the flaw leads to unauthorized access to the victim's account.
  • The CNA score is 9.1 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which corresponds to high impact on confidentiality and integrity and no required user interaction.
  • The SSVC data in the record lists technical impact as total and automatable as yes.

Affected products and versions

The record lists WebPros WHMCS in the following ranges:

  • 7.4.0 through 18.12.2 (inclusive)
  • 18.13.0 up to, but not including, 18.13.3
  • 9.0.0 up to, but not including, 9.0.4

The record contains no fixed-version list. Confirm the exact fixed release for your branch on the WHMCS advisory page before assuming a version is safe.

Exploitation status

The CVE is not listed in the CISA KEV catalog in this record, so it is not reported there as actively exploited. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00451 with a percentile of 0.37455, and the SSVC exploitation field is recorded as none.

Remediation and mitigation

  • Prioritize patching: review the WHMCS advisory page and move each installation to a release outside the affected ranges.
  • Inventory: identify every WHMCS instance and its exact version, including the 7.x, 9.0.x and 18.x branches.
  • Interim measures: limit client area registrations where business rules allow, and review accounts with unusual add-on activity until patches are applied.
  • Verify after update: confirm the installed version and that the ownership check is enforced for add-on identifiers.

Detection guidance

  • Review web server and WHMCS application logs for requests to clientarea.php that reference addonId values not associated with the authenticated session's account.
  • Look for account activity, such as changes to contact details or service views, originating from unexpected IP addresses or sessions shortly after such requests.
  • Alert on repeated identifier-changing requests from a single client session, which can indicate enumeration of other customers' objects.

Limitations of the available information

  • The record contains no fixed version, patch diff, or detailed technical analysis beyond the description.
  • The source status is Deferred, and the record does not include an NVD analysis narrative.
  • The EPSS date in the record is later than the publication date; treat that field with caution.
  • The vendor reference was not reviewed in full for this analysis, so fixed versions and any workarounds must be confirmed there.

Frequently asked questions

What is the core weakness in CVE-2026-29204?

The record describes an insufficient ownership check in clientarea.php. An authenticated client area user can reference another user's addonId without the application validating that the object belongs to them.

Which WHMCS versions does the record list as affected?

The record lists 7.4.0 through 18.12.2 inclusive, 18.13.0 before 18.13.3, and 9.0.0 before 9.0.4. Confirm fixed releases on the WHMCS advisory page.

Is this CVE known to be actively exploited?

It is not listed in the CISA KEV catalog in this record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.