Incorrect Authorization in WebPros Plesk XML-RPC API

Executive Summary

CVE-2026-56843 is a security vulnerability in the XML-RPC API of WebPros Plesk versions before 18.0.78.4. It allows a low-privileged authenticated customer to look up domains they do not own because ownership checks are only enforced for certain lookup filters and schema validation is bypassed for legacy protocol versions.

This flaw results in cross-tenant disclosure of other tenants' FTP credentials, which are stored in cleartext. Attackers can leverage these credentials to execute code as another tenant's system user.

The vulnerability affects XML protocol versions below 1.4.2.0 and all Plesk versions below 18.0.79, with 18.0.79 being the patched version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to FTP credentials of other tenants, which are stored in cleartext.

An attacker with these credentials can upload malicious files and execute arbitrary code remotely (Remote Code Execution) as another tenant's system user.

The overall impact includes a high risk of confidentiality, integrity, and availability breaches, as reflected by the CVSS score of 9.9.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability CVE-2026-56843 in Plesk's XML API, users should update to the latest Plesk Obsidian build, specifically version 18.0.79 or later, as this version contains the patch.

As a temporary mitigation, users can disable API access by editing the panel.ini file and adding the following section:

• [api] enabled = off

Useful 0 Not Useful 0

Compliance Impact

This vulnerability results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can lead to unauthorized access and remote code execution. Such unauthorized disclosure of sensitive credentials can violate data protection principles required by common standards and regulations like GDPR and HIPAA, which mandate strict controls over access to personal and sensitive data.

Specifically, the exposure of cleartext FTP passwords and the potential for unauthorized code execution represent significant security risks that could lead to breaches of confidentiality, integrity, and availability of data, thereby impacting compliance with these regulations.

Useful 0 Not Useful 0