cPanel – Modifyacct ACL Failures (R911-0139)

Type: ACL Failures
Location: Remote
Impact: Low
Product: cPanel
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version:, &
CVE: -
R911: 0139
Date: 2014-03-31
By: Rack911

Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

It is possible for a reseller to enable and/or disable certain features for their sub accounts that should not be available to them as they are intended for admins only.


We have deemed this vulnerability to be rated as LOW due to the fact that no sensitive data can be obtained and this is more of a nuisance exploit than anything else.

Vulnerable Version:

This vulnerability was tested against cPanel 11.40.0 #19 and is believed to exist in all versions prior to the fixed builds below.

Fixed Version:

This vulnerability was patched in cPanel, &

Vendor Contact Timeline:

2013-12-25: Vendor contacted via email.
2014-02-05: Vendor confirms vulnerability.
2014-03-24: Vendor issues updates to all builds.
2014-03-31: Rack911 issues security advisory.