CVE-2026-65642

Received Received - Intake

Insecure Direct Object Reference in Plesk

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: HackerOne

Description

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-65642

EUVD

EUVD-2026-66763

Affected Vendors & Products

Vendor	Product	Version / Range
plesk	plesk	to 18.0.80.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an insecure direct object reference (IDOR) in Plesk versions 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3. It allows remote authenticated users to read and modify databases belonging to other customers.

Detection Guidance

This vulnerability is specific to Plesk versions 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3. To detect it, check your Plesk version using the command 'plesk version' in the terminal. If your version falls within the affected range, the system is vulnerable.

Impact Analysis

If you are a Plesk user, this vulnerability could allow attackers with valid credentials to access or alter your data and other users' data without authorization. This may lead to data breaches, loss of confidentiality, or unauthorized modifications.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access or modification. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Update Plesk to a version later than 18.0.80.3 to address the insecure direct object reference vulnerability affecting database access.

Hi! I’m here to help you understand CVE-2026-65642. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70