CVE-2026-65916 Details
Description
CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status files, and remove database records belonging to other tenants.
A missing authorization vulnerability has been identified in CyberPanel versions through 1.9.1, within the backup management functionality. This vulnerability allows authenticated users to manipulate other tenants' backup processes and data. Specifically, users can send crafted POST requests to the 'cancelBackupCreation' handler, including arbitrary 'backupCancellationDomain' and 'fileName' parameters. Exploitation of this vulnerability enables users to terminate ongoing backup processes, delete backup archives, corrupt backup status files, and remove database records related to other tenants. The issue arises from the absence of ownership checks in the 'cancelBackupCreation' handler, which fails to verify whether the user has the right to modify the specified backup for the given domain.
Users can update to CyberPanel version 1.9.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 23, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/usmannasir/cyberpanel/commit/b1984603f9b0099b39bca46fea176e53b6d4d601 | [email protected] | Source CodeVendor |
| https://github.com/usmannasir/cyberpanel/issues/1829 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/cyberpanel-missing-authorization-in-cancelbackupcreation-handler | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CyberPanel | <= 1.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |