I have been using cpanel for about a decade. It's been great - until now. There are some security / privacy issues that most cpanel users are unaware of.

As a webmaster, I set up the website and all required emails, and in some cases, hand over cpanel control to the client. In a previous version of cpanel, the client admin user, who is someone relatively junior (never the boss - who has better things to do), was not able click on an email in the control panel and login without knowing that account's password. Worked well; simple security for non-techies.

In the latest version of cpanel, this layer of security was removed. The cpanel login now allows you to immediately login to all emails. What's the repercussions you may ask?

- imagine a low-level staff being able to read all emails in all inboxes (ie of all staff)
- able to send out emails as that user 
- able to read the emails of all management staff 
- able to login to the CEO's email account and send out incriminating or nasty emails
- able to use a staff's email to send out hate mail or give company secrets to competitors. If traced back, that user get's into trouble, not the cpanel admin!
- the webmaster who sets up the hosting account can do the above as well (he is an external party).

The security and privacy issues are glaring.

What is cpanel's response?
"This is by design and it is not a security problem. The cPanel account user always has access to all of the data in all of the mailboxes on the account. "

I see many users complaining about this since last year but cpanel is sticking to its position. What's with these guys?! I may have to switch to Plesk, etc because of this.