CVE-2026-65916
Received Received - Intake

CyberPanel Missing Authorization in Backup Handling

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status files, and remove database records belonging to other tenants.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65916
EUVD
EUVD-2026-48306

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
usmannasir cyberpanel to 1.9.1 (inc)
cyberpanel cyberpanel 1.9.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65916 is a missing authorization vulnerability in CyberPanel versions up to 1.9.1. It allows authenticated users to manipulate backups belonging to other tenants by sending crafted POST requests with arbitrary parameters like backupCancellationDomain and fileName. Attackers can terminate backup processes, delete backup archives, corrupt status files, and remove database records of other users.

Detection Guidance

Monitor for unusual POST requests targeting the CyberPanel backup endpoints, particularly those with arbitrary backupCancellationDomain or fileName parameters. Check logs for failed backup operations or corrupted backup status files. Review network traffic for requests to /backup/backupManager.py or /IncBackups/views.py with suspicious parameters.

Impact Analysis

This vulnerability can lead to data loss, backup corruption, and denial of service for other tenants. Attackers with low privileges can disrupt critical backup operations, delete archives, or corrupt status files, potentially causing permanent data damage. The exploit runs as root, amplifying the impact across the system.

Compliance Impact

This vulnerability can violate compliance requirements such as GDPR and HIPAA by enabling unauthorized access to and manipulation of tenant data. It undermines data integrity, availability, and confidentiality, which are core principles of these regulations. Organizations using affected CyberPanel versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade CyberPanel to the latest version containing commit b198460. Ensure all users have only necessary permissions and avoid sharing credentials. Implement network-level restrictions to block unauthorized access to backup endpoints. Review and remove any suspicious backup operations or corrupted files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65916. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart