This vulnerability (CVE-2026-32991) in WebPros cPanel arises from incorrect authorization (CWE-863) where team member privilege checks are insufficient. As a result, a team member with limited privileges can escalate their access to that of the team owner account. The affected versions include multiple releases from 11.110.0.0 up to 11.136.0.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the team member level, no user interaction, unchanged scope, limited confidentiality impact, high integrity impact, and no availability impact.

Successful exploitation allows a team member to gain team owner privileges, which could lead to unauthorized administrative actions within cPanel. This compromises the integrity of the system by enabling privilege escalation. Confidentiality impact is limited, and availability is not affected. There are no known active exploits targeting this vulnerability currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, organizations should monitor vendor communications closely. Until a patch is available, consider restricting team member privileges and reviewing team membership to minimize risk.