{"id":"CVE-2026-82977","aliases":[],"cve":{"records":[{"id":"CVE-2026-82977","source":"hackerone","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-31T15:00:00.543Z","published":"2026-11-12T17:01:19.318Z","modified":"2026-11-12T17:01:19.318Z"}],"publishers":[{"name":"hackerone","role":"CNA","organizationId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","modified":"2026-11-12T17:01:19.318Z"}],"references":[{"url":"https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics","tags":[],"source":"hackerone"}],"weaknesses":[{"id":"CWE-732","description":"CWE-732 Incorrect Permission Assignment for Critical Resource","source":"hackerone"}],"applicability":[],"prioritization":[]},"title":"The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription…","titleSource":"hackerone","descriptionSource":"hackerone","description":"The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure.","score":8.4,"severity":"high","published":"2026-11-12T17:01:19.318Z","modified":"2026-11-12T17:01:19.318Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"WebPros","name":"Plesk","platforms":[],"versions":[{"version":"18.0.77","status":"affected","lessThanOrEqual":"18.0.81.7","versionType":"semver"},{"version":"18.0.82","status":"affected","lessThanOrEqual":"18.0.82.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"hackerone","url":"https://www.cve.org/CVERecord?id=CVE-2026-82977"}],"remediation":[{"text":"-","source":"hackerone","url":"https://www.cve.org/CVERecord?id=CVE-2026-82977"}],"references":["https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics"],"sources":[{"name":"CVE","id":"CVE-2026-82977","modified":"2026-11-12T17:01:19.318Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-82977"}],"assessments":[{"source":"hackerone","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L","score":8.4}],"sourceAffected":[],"observedAt":"2026-11-12T19:01:57.204Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:45:30.999Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-12T23:20:32.271Z","attemptedAt":"2026-11-12T23:20:32.271Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-12T23:15:35.639Z","attemptedAt":"2026-11-12T23:15:35.639Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T23:15:36.674Z","attemptedAt":"2026-11-12T23:15:36.674Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-12T23:20:32.271Z","attemptedAt":"2026-11-12T23:20:32.271Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-9qh3-rppc-64c3","url":"https://github.com/advisories/GHSA-9qh3-rppc-64c3","modified":"2026-11-12T18:31:49Z","checkedAt":"2026-11-12T23:15:35.639Z"},{"source":"ENISA EUVD","id":"EUVD-2026-124553","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124553","modified":"Nov 12, 2026, 5:01:19 PM","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L","checkedAt":"2026-11-12T23:15:36.674Z"},{"source":"NVD","id":"CVE-2026-82977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82977","modified":"2026-11-12T22:09:39.233","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-12T23:20:32.271Z"}],"aiSummary":{"text":"Plesk Obsidian for Linux versions 18.0.77 to 18.0.81.7 and 18.0.82 to 18.0.82.2 have a weakness that allows cross-subscription information disclosure. The Plesk GoAccess statistics integration is affected. Local access may be required.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-12T20:11:12.352Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-82977"}]}}