---
id: "CVE-2026-105475"
kind: "vulnerability"
aliases: ["CVE-2026-105475"]
title: "cPanel & WHM: anyone with no account can read any mail account's calendar and contacts"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "cPanel & WHM", "fixed": ["134.0.67", "136.0.51", "138.0.19"], "affected": ">= 124, < 134.0.67 (134 track); < 136.0.51 (136 track); < 138.0.19 (138 track)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["calendar", "cpanel", "hosting", "infrastructure", "mail-server", "whm"]
not_affected_if: ["managed-hosting-already-updated", "patched-build"]
published_at: "2026-11-02T21:17:22+00:00"
first_seen_at: "2026-11-02T21:35:40+00:00"
updated_at: "2026-11-02T21:38:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105475", "first_seen_at": "2026-11-02T21:35:40+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T21:38:28+00:00"}]
---

# cPanel & WHM: anyone with no account can read any mail account's calendar and contacts

cPanel says a flaw in cPanel & WHM v124 and later lets an attacker with no account and no credentials read the calendar entries and contacts of any mail account on the server. NVD attributes it to improper neutralization of a NUL byte. The vendor page does not describe the request path and does not say whether it is exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:cPanel & WHM affected >= 124, < 134.0.67 (134 track); < 136.0.51 (136 track); < 138.0.19 (138 track) fixed 134.0.67, 136.0.51, 138.0.19

## How to check

Run /usr/local/cpanel/cpanel -V. You are exposed if the version is v124 or later and below the patched build for your track: 134.0.67, 136.0.51 or 138.0.19.

## Fix

Update cPanel & WHM to 134.0.67, 136.0.51 or 138.0.19 (or later), depending on your release track. Run /scripts/upcp.

## Timeline

- 2026-11-02T21:35:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105475
- 2026-11-02T21:38:28+00:00 analyst — Read cPanel's own advisory (Oct 26, 2026): unauthenticated, v124+, patched 134.0.67/136.0.51/138.0.19. Vendor does not mention NUL byte (that is NVD's wording) or exploitation; exploited left false/unknown. No mitigations or PoC found; no social search done.

## Documents

- [advisory] cPanel: Security CVE-2026-105475 Unauthenticated Access to Calendar and Contact Data (Oct 26, 2026) https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-26-2026

## From the sources

Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_