CVE-2026-56843

{
  "id": "CVE-2026-56843",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T01:16:28.277",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be leveraged to execute code as another tenant's system user."
    },
    {
      "lang": "es",
      "value": "Autorización incorrecta en la API XML-RPC de WebPros Plesk anterior a 18.0.78.4 permite a un cliente autenticado con bajos privilegios buscar dominios que no le pertenecen, porque la propiedad solo se aplica para ciertos filtros de búsqueda y la validación de esquema se omite para versiones de protocolo heredadas. Esto resulta en la divulgación entre inquilinos de las credenciales FTP de otros inquilinos almacenadas en texto claro, lo que puede ser aprovechado para ejecutar código como usuario del sistema de otro inquilino."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Webpros",
          "product": "Plesk",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "10.4",
              "lessThan": "18.0.78.4",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-08T13:04:03.813528Z",
          "id": "CVE-2026-56843",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.plesk.com/hc/en-us/articles/41178305151255-Vulnerability-in-Plesk-XML-API-Cleartext-FTP-Password-Exposure",
      "source": "[email protected]"
    }
  ]
}