This vulnerability (CVE-2026-32991) in WebPros cPanel arises from incorrect authorization (CWE-863) where team members' privilege checks are insufficient, enabling privilege escalation to the team owner role. Affected versions include multiple releases from 11.110.0.0 to 11.136.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) indicates network attack vector, low attack complexity, privileges required at the team member level, no user interaction, unchanged scope, limited confidentiality impact, high integrity impact, and no availability impact. The vulnerability was published on 2026-05-13. No patch or official remediation level has been disclosed, and no exploits are known in the wild.

Successful exploitation allows a team member with limited privileges to escalate to the team owner account, potentially leading to unauthorized administrative actions and modification of critical data within cPanel. The integrity of the system is highly impacted, while confidentiality impact is limited and availability is unaffected. This could compromise the security posture of affected cPanel installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor WebPros advisories for updates. Until a patch is available, restrict team member privileges carefully and consider limiting network exposure of affected cPanel versions to trusted environments.