CVE-2026-107854 in Jexactyl
Summary
by MITRE • 10/10/2026
Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled server_id and loads the server without restricting the lookup to servers owned by the authenticated account. On installations with billing enabled, an authenticated user can renew or unsuspend another tenant's billable server when its renewal_date is non-null and more than seven days away, even without a subuser relationship to that server. This issue is fixed in version 4.0.5.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in Jexactyl versions ranging from 4.0.0 through 4.0.5 represents a critical failure in access control mechanisms within the application's billing subsystem. Specifically, the POST /api/client/billing/free/process endpoint was designed to handle the processing of free server renewals or unsuspension actions for clients utilizing the platform's billing features. However, the implementation failed to enforce proper authorization checks regarding resource ownership. When a user authenticated and initiated this request by providing a client-controlled server_id parameter, the backend logic retrieved the specified server object without verifying whether that server was actually owned by or associated with the authenticated account making the request. This lack of restrictive lookup means that any validly authenticated user could manipulate the state of servers belonging to other tenants on the same installation, provided certain conditions were met regarding the billing status and timing of those servers.
From a technical perspective, this flaw constitutes an Insecure Direct Object Reference (IDOR) vulnerability, which is categorized under CWE-639 in the Common Weakness Enumeration standards. The core issue lies in the server-side logic trusting client-supplied identifiers without performing secondary validation against the user's authorized resource list. By accepting any arbitrary server_id and proceeding with state-changing operations such as renewing a subscription or removing an unsuspension flag, the application exposes itself to unauthorized access patterns. This is particularly dangerous because it allows for lateral movement within the multi-tenant environment of the game management panel. An attacker does not need elevated privileges; they only require valid authentication credentials for any account on the system to exploit this weakness against other users' resources.
The operational impact of this vulnerability is significant, primarily affecting installations where billing features are enabled and active. If a server's renewal_date is set to a future date that is more than seven days away, an authenticated user can trigger actions that effectively renew or unsuspend another tenant's billable server without authorization. This capability disrupts the integrity of the multi-tenant isolation model, allowing one customer to interfere with the operational status of another. In practical terms, this could lead to service disruptions for victims if their servers are unexpectedly suspended or renewed in a manner they did not authorize, potentially causing financial loss or downtime for game services hosted on those machines. Furthermore, it undermines trust in the platform's security posture and billing integrity, as users cannot rely on the system to correctly isolate their resources from other tenants' actions.
This vulnerability aligns with several tactics within the MITRE ATT&CK framework, particularly T1078 Valid Accounts, where an attacker uses legitimate credentials to gain access, and potentially T1496 Remote Service Availability Impact if the exploitation leads to denial of service for affected customers through unauthorized suspension or configuration changes. The ability to manipulate billing states also touches upon financial fraud vectors, although in this specific context, it is more about resource manipulation than direct monetary theft via payment processing errors.
To mitigate this vulnerability and prevent similar issues in future development, immediate action must be taken by upgrading the Jexactyl installation to version 4.0.5 or later, where this access control flaw has been resolved. For organizations unable to upgrade immediately due to compatibility constraints, implementing a Web Application Firewall (WAF) rule that strictly validates server_id parameters against user ownership records at the proxy level can provide temporary relief, though this is not a substitute for fixing the application code. Developers should also conduct a thorough review of all API endpoints involving resource manipulation to ensure that every request performs strict authorization checks verifying that the authenticated user has explicit permission over the target resource ID before executing any state-changing operations. Adhering to these practices ensures robust multi-tenant isolation and maintains the integrity of billing and server management functions within the platform.