customer can download raw access logs for a foreign domain(separate customer)

[rapidfire911]

We have a customer who can log into http://domain.com:2082/frontend/x/raw/index.html and they can download a domains raw access log that doesnt belong to them(separate customer). It looks like it is some kind of bug in cpanel because I have noticed it with a couple customers on different servers. Any information would be greatly appreciated.

[linux-image]

try opening /var/cpanel/users/username , where username is the username of any other customer , whom ur primary customer is able to access log. see if the OWNER is set to your primary customer username

or if the /var/cpanel/users/primary has the entry for any of the other domains, he is able to see the logs..

its confusing .. i know.. but cant help.