CVE-2021-26267: 
cPanel vulnerability analysis and mitigation

cPanel before version 92.0.9 contains a security vulnerability (CVE-2021-26267) that allows MySQL users with old-style password hashes to bypass suspension. The vulnerability was discovered and disclosed in January 2021, affecting all cPanel installations prior to version 92.0.9 (NVD Database).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) and a CVSS v2.0 base score of 5.0 (MEDIUM). The vulnerability allows unauthorized access by bypassing security controls specifically related to user suspension mechanisms when using old-style MySQL password hashes (NVD Database).

The vulnerability enables MySQL users with old-style password hashes to circumvent suspension measures, potentially allowing unauthorized access to database resources and compromising the system's security controls (NVD Database).

The vulnerability can be exploited remotely without requiring user interaction. The attack complexity is considered low, making it relatively straightforward for attackers to exploit (NVD Database).

The vulnerability has been patched in cPanel version 92.0.9. System administrators are advised to upgrade to this version or later to address the security issue. The fix is documented in the security advisory SEC-579 (cPanel Changelog).