Softaculous Virtualizor versions prior to 3.2.9 (Patch 9) and 3.0.0 contain an authorization bypass vulnerability in the billing module handler. An unauthenticated attacker can exploit this by sending a POST request with specially crafted 'act' and 'from_billing_module' parameters along with arbitrary 'uid' and 'balance' values in the 'billing_data' field to the admin panel dispatcher. This triggers an unauthorized parameterized UPDATE query against the users table, enabling modification of any tenant's account balance without authentication.

Successful exploitation allows unauthenticated remote attackers to arbitrarily modify the account balance of any tenant in the system. This can lead to financial manipulation and potentially automated suspension of services for targeted accounts, impacting availability and trust in the billing system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the admin panel dispatcher and monitor for suspicious POST requests targeting the billing module handler.