cancel_account.php in WHM AutoPilot 2.5.30 and previous versions allows remote malicious users to cancel requests for arbitrary accounts via a modified c parameter.