Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-43643

CVE-2026-43643HIGH

Softaculous Virtualizor Authorization Bypass via Billing Module Handler

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   H   N    8.7   .0062   48.0     —

AFFECTED
  Product      Versions     Fixed
  Virtualizor  unspecified  3.0.0

TIMELINE
  May 1   Reserved by VulnCheck
  Sep 22  Published (CNA: VulnCheck)
  Oct 1   EXPLOIT PUBLISHED — CVE-2026-43643 (Softaculous Virtualizor). Public exploit reference added.

CWE-862 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

Description

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and from_billing_module parameters to the admin panel dispatcher. Attackers can send a POST request with arbitrary uid and balance values in the billing_data field to trigger an unauthenticated parameterized UPDATE against the users table, enabling account balance manipulation and potential automated service suspension for targeted accounts.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
May 1, 2026	Reserved	Reserved by VulnCheck
September 22, 2026	Published	Published (CNA: VulnCheck)
October 1, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-43643 (Softaculous Virtualizor). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Softaculous	Virtualizor	—	—	3.0.0

Weaknesses

CWE-862

References (4)

https://www.virtualizor.com/blog/virtualizor-3-2-9-launched-release-candidate-patch-9/ [release-notes, patch]
https://www.virtualizor.com/blog/virtualizor-3-3-0/ [release-notes, patch]
https://www.vulncheck.com/advisories/softaculous-virtualizor-authorization-bypass-via-billing-module-handler [third-party-advisory]
https://www.vulncheck.com/blog/virtualizor-billing-hook-unauthenticated-root-rce [technical-description, exploit]

Authoritative record: CVE-2026-43643 at cve.org

Vendors: softaculous

Weaknesses: CWE-862

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-43643 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.