Incorrect Authorization in WebPros Plesk XML-RPC API

Executive Summary

CVE-2026-56843 is a security vulnerability in the XML-RPC API of WebPros Plesk versions before 18.0.78.4. It allows a low-privileged authenticated customer to look up domains they do not own because ownership checks are only enforced for certain lookup filters and schema validation is bypassed for legacy protocol versions.

This flaw results in cross-tenant disclosure of other tenants' FTP credentials, which are stored in cleartext. Attackers can leverage these credentials to execute code as another tenant's system user.

The vulnerability affects XML protocol versions below 1.4.2.0 and all Plesk versions below 18.0.79, with 18.0.79 being the patched version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to FTP credentials of other tenants, which are stored in cleartext.

An attacker with these credentials can upload malicious files and execute arbitrary code remotely (Remote Code Execution) as another tenant's system user.

The overall impact includes a high risk of confidentiality, integrity, and availability breaches, as reflected by the CVSS score of 9.9.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability CVE-2026-56843 in Plesk's XML API, users should update to the latest Plesk Obsidian build, specifically version 18.0.79 or later, as this version contains the patch.

As a temporary mitigation, users can disable API access by editing the panel.ini file and adding the following section:

• [api] enabled = off

Useful 0 Not Useful 0

Compliance Impact

This vulnerability results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can lead to unauthorized access and remote code execution. Such unauthorized disclosure of sensitive credentials can violate data protection principles required by common standards and regulations like GDPR and HIPAA, which mandate strict controls over access to personal and sensitive data.

Specifically, the exposure of cleartext FTP passwords and the potential for unauthorized code execution represent significant security risks that could lead to breaches of confidentiality, integrity, and availability of data, thereby impacting compliance with these regulations.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your system, you should first identify if your Plesk installation is running a version below 18.0.79, as these versions are affected.

Since the vulnerability involves the XML-RPC API protocol versions below 1.4.2.0 exposing cleartext FTP passwords, you can monitor network traffic for XML API requests that use legacy protocol versions.

One approach is to capture and analyze network traffic to the Plesk server on the XML API port (usually port 8443) to look for suspicious XML-RPC calls that might be exploiting the vulnerability.

• Use tcpdump or tshark to capture traffic on port 8443: sudo tcpdump -i any port 8443 -w plesk_api_traffic.pcap
• Analyze captured traffic for XML-RPC requests with protocol versions below 1.4.2.0 using tshark or Wireshark.
• Check Plesk version with the command: plesk version

If you find legacy XML-RPC API calls or are running an affected Plesk version, it indicates potential exposure to this vulnerability.

Useful 0 Not Useful 0