CVE-2026-107854 Details
Description
Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled server_id and loads the server without restricting the lookup to servers owned by the authenticated account. On installations with billing enabled, an authenticated user can renew or unsuspend another tenant's billable server when its renewal_date is non-null and more than seven days away, even without a subuser relationship to that server. This issue is fixed in version 4.0.5.
A vulnerability in Jexactyl's game management panel, specifically in versions 4.0.0 prior to 4.0.5, allows authenticated users to manipulate billing states of servers owned by other tenants. The issue arises in the POST /api/client/billing/free/process endpoint, where the server_id parameter is not properly scoped to the authenticated user's account. This oversight enables users to renew or unsuspend billable servers of other tenants, provided the target server's renewal date is more than seven days away. The vulnerability is present when the billing module is enabled, a common configuration for Jexactyl installations.
Users are advised to update to Jexactyl version 4.0.5, where this vulnerability has been fixed. In addition, the server lookup process can be modified to ensure that only servers owned by the authenticated user are accessed, thereby preventing unauthorized cross-tenant server management.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Jexactyl/Jexactyl/commit/356a5b46a18d483ae90c862e130b1969e6df0777 | [email protected] | Source CodeVendor |
| https://github.com/Jexactyl/Jexactyl/releases/tag/v4.0.5 | [email protected] | Release NotesVendor |
| https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-9xwv-p7r5-5h5p | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Jexactyl | >= 4.0.0, < 4.0.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |