CVE-2026-56843 is a critical authorization vulnerability in the XML-RPC API of WebPros Plesk versions prior to 18.0.78.4. The issue arises because ownership checks are only applied to certain lookup filters, and schema validation is bypassed for legacy protocol versions. This allows authenticated users with low privileges to enumerate domains belonging to other tenants and retrieve their FTP credentials stored in cleartext. The exposed credentials can be used to execute code under the context of another tenant’s system user, resulting in a complete compromise of tenant isolation.

The vulnerability enables cross-tenant information disclosure of FTP credentials in cleartext, which can lead to unauthorized code execution as another tenant’s system user. This compromises confidentiality, integrity, and availability of affected systems, potentially allowing attackers to fully control other tenants' environments within the same Plesk installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, restrict access to the XML-RPC API to trusted users only and monitor for suspicious activity involving domain lookups. Consider disabling legacy protocol versions if possible to reduce exposure.