PLESK OBSIDIAN FOR LINUX · CVE-2026-82977 · Vendor
FIX → 18.0.82.3 +1 ✓ verified
The GoAccess statistics integration in Plesk Obsidian for Linux exposes information across hosting subscriptions. A customer on one subscription can read data belonging to another subscription on the same server.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers running Plesk Obsidian for Linux 18.0.77 to 18.0.81.7 or 18.0.82 to 18.0.82.2, where the GoAccess web statistics integration lets one subscription read another's statistics. The exposed data can include requested URLs with any tokens in them, visitor IP addresses and referring pages. Plesk for Windows is not affected. Hosts with a single customer have little cross-customer exposure, but should still update.
Not affected if no-goaccess-integration, outside-affected-range
Who cares goaccess, hosting, linux, plesk, shared-hosting
plesk version on the server18.0.77 to 18.0.81.7 or 18.0.82 to 18.0.82.2 (Plesk for Linux)The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
18.0.81.8, 18.0.82.3 or laterUpgrade to 18.0.82.3 +1
18.0.81.8 or 18.0.82.3 or later