Security Breach between accounts

[vrinteractive]

So I have tested this with a couple of domains on different platforms.

I have two domains
www.mydomain.com : user mydomain
www.yourdomain.com : user yourdomain

http://mydomain.com:2082/frontend/x/indexmanager/index.html?dir=/home/mydomain/public_html/
use mydomain to login

then go to

http://yourdomain.com:2082/frontend/x/indexmanager/index.html?dir=/home/yourdomain/public_html/
you can go in and edit this without having to re-authenticate.
This seems like a SIGNIFICANT security hole.

Please advise

 

[jester.ro]

doesn't work on 3 servers that i tested on.

 

[vrinteractive]

I'm running on:
WHM 10.0.0 cPanel 10.0.0-R85
Fedora i686 - WHM X v3.1.0

 

[chirpy]

If you can recreate the issue, then you should inform [email protected] immediately.

Edit: Your user account password isn't the same as your root or reseller password is it?

 

[ntwaddel]

it does not work on my server either

 

[vrinteractive]

I believe it was that sessions were not disconnecting after logout. my apologies