ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-43643

Softaculous Virtualizor Authorization Bypass via Billing Module Handler

CVSS 4.0 8.7 HIGHCVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-43643

Published

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and from_billing_module parameters to the admin panel dispatcher. Attackers can send a POST request with arbitrary uid and balance values in the billing_data field to trigger an unauthenticated parameterized UPDATE against the users table, enabling account balance manipulation and potential automated service suspension for targeted accounts.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-43643

Published

Virtualizor

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "vendor": "Softaculous",
                    "product": "Virtualizor",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "versionType": "custom",
                            "lessThan": "3.2.9 (Patch 9)"
                        },
                        {
                            "status": "unaffected",
                            "version": "3.0.0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON