Any user can access all reseller accounts!

[olliemaitland]

I have a major problem in that whenever a user logs in to cPanel they can access any of the other accounts within the reseller/account owner group!

I'm running WHM 9.4.0 cPanel 9.4.1-S65
RedHat Enterprise 3 - WHM X v3.1.0

i have now upgraded to WHM 9.4.0 cPanel 9.4.1-R64 but the problem persists...

does anyone have any ideas??

This is a major problem and I need to fix it immediately or have to turn the server off...

[olliemaitland]

Is there a way to edit the xfercpanel file so it doesnt work?

[SarcNBit]

whenever a user logs in to cPanel they can access any of the other accounts within the reseller/account owner group!

I am not seeing this behavior.

Why don't you submit a bug report describing the problem. If the issue is universal, you would be better off contacting security@cpanel.net.

[xion]

Is it just you that is able to do this? Or your users also? Because if you login with the reseller password, you will be able to switch between any of your resold users accounts. It is designed that way.

[tcaetano]

Is it just you that is able to do this? Or your users also? Because if you login with the reseller password, you will be able to switch between any of your resold users accounts. It is designed that way.

I think his talking about the opposite! A regular user getting access to any other accounts. At least I understood that way...

[olliemaitland]

Yeah sorry - any user can access any other account wihtin their resold group!

I'm in Tibet so it's proving tricky to manage the server...u have submitted a support ticket...
#67824

It appears to not be affecting all the accounts so i'll double check the other root access individual has not done something funky!