CVE-2026-65642 Overview
CVE-2026-65642 is an Insecure Direct Object Reference (IDOR) vulnerability in Plesk's database management interface. The flaw affects Plesk 18.0.79.7 and earlier, as well as 18.0.80 through 18.0.80.3. Remote authenticated users can read and modify databases belonging to other customers on the same server. The weakness maps to [CWE-639: Authorization Bypass Through User-Controlled Key]. Successful exploitation breaks tenant isolation on shared hosting deployments and exposes customer data across account boundaries.
Critical Impact
Authenticated customers can access and alter databases owned by other tenants, breaking multi-tenant isolation in shared Plesk environments.
Affected Products
- Plesk 18.0.79.7 and earlier
- Plesk 18.0.80 through 18.0.80.3
- Plesk database management interface
Discovery Timeline
- 2026-08-26 - CVE-2026-65642 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-65642
Vulnerability Analysis
The vulnerability resides in Plesk's database management interface. The interface uses a user-supplied identifier to select the target database without validating that the requesting account owns that resource. An authenticated customer can substitute another tenant's database identifier and receive full read and modify access. The attack requires only low-privilege credentials on the Plesk server and completes over the network without user interaction.
Root Cause
The root cause is missing object-level authorization on database operations, classified as [CWE-639]. Plesk trusts the database reference supplied in the request rather than verifying it against the authenticated user's ownership records. Any parameter tampering that changes the database identifier bypasses the intended tenant boundary.
Attack Vector
An attacker authenticates to Plesk as a standard customer. The attacker then issues requests to the database management endpoints with a modified database identifier pointing to another customer's database. The server executes read or write operations against that database and returns results to the attacker. No additional privileges, social engineering, or chained flaws are required.
No public proof-of-concept has been published. Refer to the Plesk Security Advisory CVE-2026-65642 for vendor technical details.
Detection Methods for CVE-2026-65642
Indicators of Compromise
- Authenticated Plesk sessions accessing database identifiers not associated with the session's customer account.
- Database queries or schema changes executed against customer databases without corresponding control-panel activity from the owning account.
- Unexpected mysqldump, SELECT, INSERT, UPDATE, or DROP operations in MySQL or MariaDB logs originating from Plesk service accounts.
Detection Strategies
- Correlate Plesk web interface access logs with database server audit logs to identify cross-tenant access patterns.
- Alert on HTTP requests to Plesk database management endpoints where the referenced database ID does not belong to the authenticated user.
- Monitor for enumeration behavior: sequential or scripted iteration over database identifiers within a single authenticated session.
Monitoring Recommendations
- Enable verbose logging on the Plesk database management interface and forward logs to a centralized SIEM.
- Track baseline database access patterns per customer and alert on deviations, particularly access to databases outside the customer's assigned subscription.
- Review MySQL/MariaDB general_log and binlog entries for writes performed by the Plesk backend on behalf of unexpected accounts.
How to Mitigate CVE-2026-65642
Immediate Actions Required
- Upgrade Plesk to a version later than 18.0.80.3 that contains the vendor fix referenced in the Plesk Security Advisory.
- Audit database access logs for the period preceding the upgrade to identify potential cross-tenant access.
- Rotate database credentials for customer databases if unauthorized access is suspected.
Patch Information
Plesk has released a security update addressing CVE-2026-65642 in its database management interface. Administrators should apply the vendor-supplied update through the Plesk Updates interface or plesk installer command. Consult the Plesk Security Advisory CVE-2026-65642 for the specific fixed build.
Workarounds
- Restrict access to the Plesk control panel to trusted administrators until the patch is applied.
- Temporarily disable customer access to the database management interface via Plesk service plan permissions.
- Enforce network-level access controls on the Plesk management port to limit exposure to authenticated attackers.
# Update Plesk to the latest patched build
plesk installer --select-release-current --show-components
plesk installer update
# Verify installed Plesk version
plesk version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
