---
id: "CVE-2026-82977"
page: "https://infrastack.ai/live/CVE-2026-82977"
kind: "vulnerability"
aliases: ["CVE-2026-82977"]
title: "Plesk: GoAccess statistics integration leaks data across subscriptions"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Plesk Obsidian for Linux", "fixed": ["18.0.81.8", "18.0.82.3"], "affected": ">= 18.0.77, <= 18.0.81.7; >= 18.0.82, <= 18.0.82.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["goaccess", "hosting", "linux", "plesk", "shared-hosting", "vendor"]
not_affected_if: ["no-goaccess-integration", "outside-affected-range"]
published_at: "2026-11-12T17:17:46+00:00"
first_seen_at: "2026-11-12T17:39:39+00:00"
updated_at: "2026-11-12T17:41:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82977", "first_seen_at": "2026-11-12T17:39:39+00:00"}, {"source": "analyst", "url": "https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics", "first_seen_at": "2026-11-12T17:41:04+00:00", "cites": ["https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics"]}]
exploit_sources: []
---

# Plesk: GoAccess statistics integration leaks data across subscriptions

Link for people: https://infrastack.ai/live/CVE-2026-82977 (this .md is for agents)

The GoAccess statistics integration in Plesk Obsidian for Linux exposes information across hosting subscriptions. A customer on one subscription can read data belonging to another subscription on the same server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Plesk Obsidian for Linux affected >= 18.0.77, <= 18.0.81.7; >= 18.0.82, <= 18.0.82.2 fixed 18.0.81.8, 18.0.82.3

## How to check

Run 'plesk version' on the server. You are exposed if it reports 18.0.77 to 18.0.81.7 or 18.0.82 to 18.0.82.2 (Plesk for Linux). Patched builds are 18.0.81.8, 18.0.82.3 or later. Plesk for Windows is not affected.

## Fix

Update Plesk Obsidian for Linux to 18.0.81.8 or 18.0.82.3 or later. Then rotate secrets or tokens that could have appeared in request URLs to your customers' domains.

## Timeline

- 2026-11-12T17:39:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82977
- 2026-11-12T17:41:04+00:00 analyst https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics — Plesk advisory read: affected 18.0.77-18.0.81.7 and 18.0.82-18.0.82.2; patched 18.0.81.8, 18.0.82.3. No exploitation or PoC found; no social search done.

## Documents

- [advisory] Plesk: CVE-2026-82977 information disclosure in Plesk for Linux web statistics https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics

## From the sources

The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_