Security advisory · VP-2026-004
Database permissions could reach another account's databases
In some cases, database access the panel gave one hosting account also applied to databases of another account on the same server. Vanta Panel 5.50 corrects how database permissions are granted and repairs existing ones automatically.
- Severity
- High
- Affected
- Vanta Panel 5.49 and earlier
- Fixed in
- Vanta Panel 5.50
- Component
- Databases (MySQL/MariaDB permissions)
- Published
Who is affected?
Servers with more than one hosting account. A customer could, in some cases, read, change or delete another customer's databases.
Affected: Vanta Panel 5.49 and earlier. Fixed in Vanta Panel 5.50.
What should I do?
Update to Vanta Panel 5.50 or later. If you gave a database user access by hand, outside the panel, check that access after the update.
To see which version a server runs, open vWHM: the version is shown under Updates and at the bottom of every page. Updates lists every published advisory that affects that version.
Is the fix installed automatically?
Yes. Right after the update the panel repairs existing database permissions once; if that cannot finish, it retries every hour.
Credit
Found in Vanta Panel's own security review.
References
Found a security problem in Vanta Panel?
Email security@vantapanel.com privately rather than opening a public issue. How to report a vulnerability.
Questions about VP-2026-004
Something else? Ask support or read the docs.
Which Vanta Panel versions are affected by VP-2026-004?
Vanta Panel 5.49 and earlier that have not installed the fix. It is fixed in Vanta Panel 5.50.
What should I do about VP-2026-004?
Update to Vanta Panel 5.50 or later. If you gave a database user access by hand, outside the panel, check that access after the update.
Is the fix for VP-2026-004 installed automatically?
Yes. Right after the update the panel repairs existing database permissions once; if that cannot finish, it retries every hour.
Other advisories
VP-2026-007Criticalfixed in 5.54
Critical PHP vulnerabilities CVE‑2026‑109618 and CVE‑2026‑109619
VP-2026-006Mediumfixed in 5.52
Some removed database hosts and subdomains stayed active
VP-2026-005Highfixed in 5.50
Backup restores and cPanel imports could reach other accounts' data
Keep every server on the latest release.
Automatic updates are on by default: each signed release installs itself within a day, and vWHM warns about any advisory that affects the version you run.
curl -fsSL https://get.vantapanel.com | sudo bash