{"id":"CVE-2026-82977","kind":"vulnerability","aliases":["CVE-2026-82977"],"related":[],"title":"Plesk: GoAccess statistics integration leaks data across subscriptions","description":"The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure.","summary":"The GoAccess statistics integration in Plesk Obsidian for Linux exposes information across hosting subscriptions. A customer on one subscription can read data belonging to another subscription on the same server.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Plesk Obsidian for Linux","fixed":["18.0.81.8","18.0.82.3"],"affected":">= 18.0.77, <= 18.0.81.7; >= 18.0.82, <= 18.0.82.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["goaccess","hosting","linux","plesk","shared-hosting","vendor"],"not_affected_if":["no-goaccess-integration","outside-affected-range"],"how_to_check":"Run 'plesk version' on the server. You are exposed if it reports 18.0.77 to 18.0.81.7 or 18.0.82 to 18.0.82.2 (Plesk for Linux). Patched builds are 18.0.81.8, 18.0.82.3 or later. Plesk for Windows is not affected.","fix":"Update Plesk Obsidian for Linux to 18.0.81.8 or 18.0.82.3 or later. Then rotate secrets or tokens that could have appeared in request URLs to your customers' domains.","status":"open","published_at":"2026-11-12T17:17:46+00:00","first_seen_at":"2026-11-12T17:39:39+00:00","triaged_at":"2026-11-12T17:39:48+00:00","updated_at":"2026-11-12T17:41:04+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-12T17:39:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Plesk: GoAccess statistics integration leaks data across subscriptions","impact":"medium","summary":"The GoAccess statistics integration in Plesk Obsidian for Linux exposes information across hosting subscriptions. A customer on one subscription can read data belonging to another subscription on the same server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["plesk","hosting","linux","shared-hosting"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"one hosting customer reads another customer's data","analyst_note":"Confirm the fixed version and whether a configuration change is needed; check the Plesk release notes and the NVD entry.","how_to_check":"- Check the installed Plesk Obsidian version on the server with `plesk version` and compare it to the affected range 18.0.77 to 18.0.82.2\n- Confirm whether the GoAccess statistics integration is in use","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-affected-range","no-goaccess-integration"],"who_is_affected":"Servers running Plesk Obsidian for Linux in the affected version range, where the GoAccess statistics integration is used to serve web statistics to multiple subscriptions. Single-subscription servers or servers that do not use the GoAccess integration are less exposed. The sources do not state the fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4553,"output_tokens":533,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a configuration change is needed; check the Plesk release notes and the NVD entry.","search":"'-2026':10A,13A '-82977':11A,14A '18.0.77':68C '18.0.81.7':70C '18.0.82':71C '18.0.82.2':73C 'across':7A,38B 'allow':74C 'anoth':51B 'belong':49B 'cross':76C 'cross-subscript':75C 'custom':42B 'cve':9A,12A 'data':6A,48B 'disclosur':79C 'expos':36B 'for':17A 'goaccess':2A,19B,28B,59C 'host':20B,25B,39B 'inform':37B,78C 'integr':4A,30B,61C 'leak':5A 'linux':18A,21B,35B,66C 'obsidian':16A,33B,64C 'one':44B 'plesk':1A,15A,22B,32B,58C,63C 'read':47B 'server':56B 'share':24B 'shared-host':23B 'statist':3A,29B,60C 'subscript':8A,40B,45B,52B,77C 'vendor':26B 'version':67C","nicknames":[],"mitigations":[],"who_affected":"Servers running Plesk Obsidian for Linux 18.0.77 to 18.0.81.7 or 18.0.82 to 18.0.82.2, where the GoAccess web statistics integration lets one subscription read another's statistics. The exposed data can include requested URLs with any tokens in them, visitor IP addresses and referring pages. Plesk for Windows is not affected. Hosts with a single customer have little cross-customer exposure, but should still update.","tier":"B","verified":{"fix":{"at":"2026-11-12T17:41:04Z","by":"analyst","doc":"https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics","run_id":3756},"products":{"at":"2026-11-12T17:41:04Z","by":"analyst","doc":"https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics","run_id":3756},"how_to_check":{"at":"2026-11-12T17:41:04Z","by":"analyst","doc":"https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics","run_id":3756},"who_affected":{"at":"2026-11-12T17:41:04Z","by":"analyst","doc":"https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics","run_id":3756}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["obsidianforlinux","pleskobsidianforlinux"],"ptokens":["for","linux","obsidian","plesk"],"labels":["goaccess","high","hosting","linux","plesk","sharedhosting","vendor"],"campaign_type":null,"search_a":"'-2026':10A,13A '-82977':11A,14A 'across':7A 'cve':9A,12A 'data':6A 'for':17A 'goaccess':2A 'integr':4A 'leak':5A 'linux':18A 'obsidian':16A 'plesk':1A,15A 'statist':3A 'subscript':8A","search_b":"'across':38B 'anoth':51B 'belong':49B 'custom':42B 'data':48B 'expos':36B 'goaccess':19B,28B 'host':20B,25B,39B 'inform':37B 'integr':30B 'linux':21B,35B 'obsidian':33B 'one':44B 'plesk':22B,32B 'read':47B 'server':56B 'share':24B 'shared-host':23B 'statist':29B 'subscript':40B,45B,52B 'vendor':26B","search_c":"'18.0.77':68C '18.0.81.7':70C '18.0.82':71C '18.0.82.2':73C 'allow':74C 'cross':76C 'cross-subscript':75C 'disclosur':79C 'goaccess':59C 'inform':78C 'integr':61C 'linux':66C 'obsidian':64C 'plesk':58C,63C 'statist':60C 'subscript':77C 'version':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T17:17:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82977","severity":null,"published_at":"2026-11-12T17:17:46+00:00","modified_at":"2026-11-12T17:17:46+00:00","first_seen_at":"2026-11-12T17:39:39+00:00","fetched_at":"2026-11-12T17:39:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-82977:3756","url":"https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics","severity":null,"published_at":"2026-11-12T17:41:04+00:00","modified_at":"2026-11-12T17:41:04+00:00","first_seen_at":"2026-11-12T17:41:04+00:00","fetched_at":"2026-11-12T17:41:04+00:00","note":"Plesk advisory read: affected 18.0.77-18.0.81.7 and 18.0.82-18.0.82.2; patched 18.0.81.8, 18.0.82.3. No exploitation or PoC found; no social search done.","cites":["https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics"]}],"documents":[{"id":137010,"url":"https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics","title":"Plesk: CVE-2026-82977 information disclosure in Plesk for Linux web statistics","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}