CVE-2026-43643: Softaculous Virtualizor authorization bypass in billing module

Executive brief

Softaculous Virtualizor, a virtual machine management platform, contains an authorization bypass vulnerability that allows attackers without credentials to manipulate tenant account balances. An attacker can modify billing information to suspend service for any user or gain unauthorized financial control, potentially disrupting hosted services or causing financial fraud.

Technical details

The vulnerability exists in the admin panel dispatcher's billing module handler, which fails to verify authentication before processing billing requests. An unauthenticated attacker can send a POST request with crafted act and from_billing_module parameters containing arbitrary uid and balance values, triggering an unvalidated SQL UPDATE against the users table. The issue affects Virtualizor before version 3.2.9 (Patch 9) and 3.0.0.

Affected products

• Softaculous Virtualizor before 3.2.9 (Patch 9), including 3.0.0

Timeline

• 2026-09-22: disclosed: CVE-2026-43643 published on NVD
• 2026-09-01: patched: Fix included in Virtualizor 3.2.9 (Patch 9)

References

• https://www.virtualizor.com/blog/virtualizor-3-2-9-launched-release-candidate-patch-9/
• https://www.virtualizor.com/blog/virtualizor-3-3-0/