CVE-2026-67398CWE-862broken-access-control

CVE-2026-67398

published September 4, 2026

CVSS
8.2
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.

The record
Technical detail
CVSS
8.2 · NONE
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-04T04:17Z
References (1)
https://help.whmcs.com/m/125386/l/2116695-cve-2026-67398-whmcs-security-update-2026-09-03 · [email protected]
EPSS history
Timeline
  • 05 SEP 03:43Z
    EPSS moved — → 0%
    epss
  • 03 SEP 23:57Z
    Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.8, from 9.0.0 before 9.0.8, all other EOL…
    cvelistv5