CVE-2026-107854

Received Received - Intake

Jexactyl Billing Server ID Misconfiguration Allows Unauthorized Server Renewal

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled server_id and loads the server without restricting the lookup to servers owned by the authenticated account. On installations with billing enabled, an authenticated user can renew or unsuspend another tenant's billable server when its renewal_date is non-null and more than seven days away, even without a subuser relationship to that server. This issue is fixed in version 4.0.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-09

Last Modified

2026-10-09

Generated

2026-10-10

AI Q&A

2026-10-10

EPSS Evaluated

N/A

NVD

CVE-2026-107854

Affected Vendors & Products

Vendor	Product	Version / Range
Jexactyl	Jexactyl	>= 4.0.0, < 4.0.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Jexactyl is a game management panel with billing features. Between versions 4.0.0 and 4.0.5, an endpoint allowed users to control server actions without proper ownership checks. Specifically, the POST /api/client/billing/free/process endpoint accepted a server_id parameter and processed billing actions for servers not owned by the authenticated user.

Detection Guidance

To detect this vulnerability, check Jexactyl server logs for POST requests to /api/client/billing/free/process with a server_id parameter not owned by the authenticated user. Look for unusual billing renewals or unsuspensions of servers not linked to the user's account.

Impact Analysis

If you use Jexactyl with billing enabled, an attacker with valid credentials could renew or unsuspend another user's billable server without permission. This could lead to unauthorized charges or service disruptions for other users.

Compliance Impact

This vulnerability allows unauthorized users to modify another tenant's billable server, which could lead to unauthorized access or data manipulation. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized changes to systems handling sensitive data.

Mitigation Strategies

Upgrade Jexactyl to version 4.0.5 or later to address the vulnerability. Review server ownership and billing permissions to ensure only authorized users can manage servers.

Hi! I’m here to help you understand CVE-2026-107854. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70