CVE-2026-65917
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
CyberPanel through 1.9.1, fixed in commit b198460, contains an IDOR vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, restorePoint). Authenticated panel users can access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant's backup metadata, irrecoverably delete another tenant's backup snapshots, or trigger unauthorized restoration of another tenant's backup job with root privileges.
Risk Assessment
Risk of tenant isolation breach, potentially leading to data leakage, backup loss, or unauthorized restoration with root privileges.
Recommendation
Upgrade CyberPanel to a version containing commit b198460 or later.
Other vulnerabilities in CyberPanel
See all- CVE-2026-67614Critical
CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.
- CVE-2026-41473Critical
CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to /api/ai-scanner/status-webhook and /api/ai-scanner/callback. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.
- CVE-2024-51567CriticalActively exploited
The upgrademysqlstatus function in databases/views.py in CyberPanel before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
- CVE-2024-51378CriticalActively exploited
getresetstatus in dns/views.py and ftp/views.py in CyberPanel before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
- CVE-2026-67613Medium
CyberPanel before version 3.0.0 has a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can access credential files, SSL/SSH private keys, and JWT secret files.
- CVE-2026-71966High
CyberPanel 2.4.3 contains an authenticated command injection vulnerability in the remote backup transfer feature. Attackers can control a remote server's API response and inject malicious commands via a crafted directory name, which bypasses security middleware and is passed unsanitized to the OS command execution function.
- CVE-2026-71965High
CyberPanel 2.4.3 contains an authenticated remote code execution vulnerability in the remote backup feature. Attackers can supply a malicious remote server address, allowing them to write an attacker-controlled public key to /root/.ssh/authorized_keys, granting persistent root access to the host system.
- CVE-2026-71964Medium
CyberPanel 2.4.3 contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. The application fails to validate symlinks before extraction, allowing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist and be accessed through the web interface.
- CVE-2026-65916High
CyberPanel up to version 1.9.1 lacks authorization in the cancelBackupCreation handler. An authenticated attacker can send crafted POST requests with arbitrary parameters to kill, delete, and corrupt other tenants' backups.
- CVE-2021-47949High
CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint.
Original NVD description (English source)
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant's backup metadata, irrecoverably delete another tenant's backup snapshots, or trigger unauthorized restoration of another tenant's backup job with root privileges.