CVE-2026-65917 in CyberPanel
Summary
by MITRE • 07/23/2026
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant's backup metadata, irrecoverably delete another tenant's backup snapshots, or trigger unauthorized restoration of another tenant's backup job with root privileges.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability exists within CyberPanel version 1.9.1 and earlier, where the IncBackups application fails to properly implement access controls for backup operations. The insecure direct object reference flaw specifically affects three handler functions: deleteBackup, fetchRestorePoints, and restorePoint. These functions process incremental backup operations using globally sequential IncJob integer IDs without proper domain scoping or tenant isolation mechanisms. The vulnerability stems from a fundamental design flaw where the system does not validate whether an authenticated user has legitimate access rights to perform operations on a specific backup resource identified by its IncJob ID.
The technical implementation of this vulnerability allows attackers to exploit the lack of proper authorization checks through predictable sequential ID enumeration. When a user accesses the backup management interface, the system accepts IncJob IDs directly from client requests without verifying that these IDs belong to the requesting user's tenant domain. This creates a scenario where an authenticated user can manipulate backup resources belonging to other tenants by simply guessing or enumerating valid sequential backup job identifiers. The vulnerability represents a classic idor pattern as defined by CWE-639 and falls under the broader category of insufficient authorization checks within web applications.
The operational impact of this vulnerability is severe and multifaceted, encompassing data integrity, confidentiality, and availability concerns. Attackers can enumerate backup IDs to discover and access metadata from other tenants' backup jobs, potentially exposing sensitive information about system configurations, backup schedules, and data structures. The ability to delete another tenant's backup snapshots results in permanent data loss and operational disruption for affected users. Most critically, the unauthorized restoration capability with root privileges allows attackers to execute arbitrary code with elevated permissions, effectively providing them with complete control over target systems.
Mitigation strategies should focus on implementing proper access control mechanisms that ensure all backup operations are scoped to the authenticated user's tenant domain. The system must validate that each IncJob ID corresponds to a backup resource owned by the requesting user before executing any operations. This requires implementing domain-scoping checks in the backup handler functions and ensuring that backup identifiers are not globally sequential but instead use unique identifiers tied to specific user contexts. Organizations should also implement proper input validation and access control enforcement at multiple layers of the application architecture, including API endpoints, database queries, and session management components. The vulnerability aligns with ATT&CK technique T1078 for valid accounts and T1490 for data destruction, emphasizing the need for comprehensive security controls around backup and restore operations.
This vulnerability demonstrates the critical importance of proper access control implementation in multi-tenant environments where resource isolation is essential for maintaining system security. The fix implemented in commit b198460 addresses the core issue by ensuring that IncJob IDs are properly scoped to their respective tenant domains, preventing cross-tenant resource access. Organizations running CyberPanel should immediately upgrade to versions containing this fix and implement additional monitoring for suspicious backup access patterns. The vulnerability also highlights the need for regular security audits of web application interfaces, particularly those handling sensitive data operations such as backups and restores, to identify and remediate similar authorization flaws that could compromise system integrity and user data protection.