{"uuid": "ed25ef89-53f1-4cd6-b721-8b34d857fb04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67401", "type": "seen", "source": "https://t.me/pphm_HackerNews/3072", "content": "\ud83d\udd34 New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root\n\ncPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user.\n\ncPanel published the advisory on September 8 and says every supported version of cPanel and WHM is affected.\n\nThe flaw is tracked as CVE-2026-67401. cPanel's advisory calls it an SQL injection issue in EmailTrack, but does not say which cPanel feature or privilege an account needs. cPanel's developer documentation lists an EmailTrack module that tracks email statistics, and the advisory does not say whether that is the affected code.", "creation_timestamp": "2026-09-10T00:00:12.645123Z"}