CVE-2026-68490: WebPros cPanel

High severity, CVSS 8.2. EPSS: 0.1% chance of exploitation in the next 30 days.

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

Affected products

• WebPros cPanel: from 11.120.0.0, before 11.134.0.57 (fixed in 11.134.0.57); from 11.136.0.0, before 11.136.0.41 (fixed in 11.136.0.41); from 11.138.0.0, before 11.138.0.8 (fixed in 11.138.0.8)

Published 2026-09-23. Last modified 2026-09-24.