CVE-2026-82977
Received Received - Intake

GoAccess Statistics Integration Cross-Subscription Information Disclosure in Plesk Obsidian

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: HackerOne

Description
The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-82977
EUVD
EUVD-2026-124553

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
WebPros Plesk From 18.0.77 (inc) to 18.0.81.7 (inc)
WebPros Plesk From 18.0.82 (inc) to 18.0.82.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82977 is an information disclosure vulnerability in Plesk for Linux related to the GoAccess statistics integration. It allows cross-subscription data exposure, meaning users could access web statistics data belonging to other subscriptions. This includes sensitive information such as requested URLs with tokens, visitor IP addresses, and referring pages.

Detection Guidance

Check Plesk version with 'plesk version' command. Inspect GoAccess logs for unusual cross-subscription access patterns or unauthorized data requests. Review web server logs for unexpected access to statistics URLs across different subscriptions.

Impact Analysis

This vulnerability could allow unauthorized users to view sensitive web statistics data from other subscriptions. This includes exposed tokens or secrets in URLs, visitor IP addresses, and referring pages, potentially leading to privacy breaches or further exploitation.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data such as visitor IPs and tokens. It may result in data breaches, violating privacy and security requirements under these regulations.

Mitigation Strategies

Update Plesk to version 18.0.81.8, 18.0.82.3, or later immediately. Rotate any exposed secrets or tokens found in request URLs. Review and restrict access to GoAccess statistics data to prevent cross-subscription exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82977. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...