Security: CVE-2026-105475 Unauthenticated Access to Calendar and Contact Data in cPanel & WHM – October 26, 2026
CVE-2026-105475 allows the calendar and contact data of a cPanel mail account to be retrieved without any credentials — no login required. cPanel & WHM v124 and later are affected; the fix ships in 134.0.67, 136.0.51, 138.0.19 or later. Update with sudo /scripts/upcp --force immediately: the data is readable by anyone who can reach the endpoint.
What this means under a SharedLicense license
Unauthenticated access to calendars and contacts leaks names, email addresses, phone numbers and meeting patterns of every mail account on the server — a direct privacy breach and a harvesting source for targeted phishing against those users.
Situation
A security vulnerability was discovered which allows the calendar and contact data of a mail account to be retrieved without any credentials.
Affected product version
| Product | Affected versions | Patched versions |
|---|---|---|
| cPanel & WHM | v124 and later |
|
Impact
Successful exploitation can allow an attacker with no account on the server and no credentials to read the calendar entries and contacts of any mail account the server hosts.
Call to action
Update to the latest patched version: How do I update cPanel/WHM?
Frequently Asked Questions
What is CVE-2026-105475?
Which cPanel versions fix CVE-2026-105475?
How do I apply the fix?
What data was exposed?
References
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System