CVE-2026-65917
Received Received - Intake

Insecure Direct Object Reference in CyberPanel IncBackups

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant's backup metadata, irrecoverably delete another tenant's backup snapshots, or trigger unauthorized restoration of another tenant's backup job with root privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65917
EUVD
EUVD-2026-48307

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
cyberpanel cyberpanel to 1.9.1 (inc)
cyberpanel cyberpanel 1.9.1
usmannasir cyberpanel to 1.9.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65917 is an Insecure Direct Object Reference (IDOR) vulnerability in CyberPanel versions up to 1.9.1. It affects the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint). Authenticated users can exploit a globally sequential backup ID that isn't properly scoped to their domain to access or manipulate other tenants' backup resources.

Detection Guidance

To detect this vulnerability, check if your CyberPanel version is 1.9.1 or earlier. Verify if the IncBackups module is installed and if the endpoints deleteBackup, fetchRestorePoints, and restorePoint are accessible without proper domain scoping. Test by attempting to access backup resources using sequential IncJob IDs across different domains.

Impact Analysis

This vulnerability allows attackers to read other tenants' backup metadata, delete their backup snapshots permanently, or trigger unauthorized restoration of backups with root privileges. It enables cross-tenant data exposure and destructive actions on backups.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive backup data. GDPR requires strict data protection and user consent for processing, while HIPAA mandates safeguards for protected health information. The IDOR flaw allows attackers to read, delete, or restore other tenants' backups, potentially exposing or destroying regulated data without authorization.

Mitigation Strategies

Immediately update CyberPanel to the latest commit b198460 or later. Ensure the IncBackups module is patched to scope backup IDs to authorized domains. Restrict access to the vulnerable endpoints and review user permissions to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65917. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart