{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/cyberpanel-through-1.9.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-65917"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CyberPanel (through 1.9.1)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","idor","web-panel","privilege-escalation","data-manipulation","cyberpanel"],"_cs_type":"advisory","_cs_vendors":["CyberPanel"],"content_html":"\u003cp\u003eA critical Insecure Direct Object Reference (IDOR) vulnerability, identified as CVE-2026-65917, affects CyberPanel versions up to and including 1.9.1. This flaw resides within the IncBackups application's incremental-backup handlers, specifically in the \u003ccode\u003edeleteBackup\u003c/code\u003e, \u003ccode\u003efetchRestorePoints\u003c/code\u003e, and \u003ccode\u003erestorePoint\u003c/code\u003e functions. Authenticated CyberPanel users can exploit this by manipulating a globally sequential \u003ccode\u003eIncJob\u003c/code\u003e integer ID, which is not properly re-scoped to the authorized domain. This oversight allows attackers to access or manipulate backup resources belonging to other tenants. The vulnerability enables actions such as enumerating sequential backup IDs to read another tenant's backup metadata, irreversibly deleting backup snapshots, or initiating unauthorized restoration of another tenant's backup job with elevated root privileges. This vulnerability poses a significant risk of data compromise, destruction, and unauthorized system access across multi-tenant CyberPanel deployments. The issue was fixed in commit b198460.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated attacker gains access to a CyberPanel instance.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the vulnerable \u003ccode\u003eIncBackups\u003c/code\u003e application's incremental-backup handlers (e.g., \u003ccode\u003edeleteBackup\u003c/code\u003e, \u003ccode\u003efetchRestorePoints\u003c/code\u003e, \u003ccode\u003erestorePoint\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker observes or infers the globally sequential nature of \u003ccode\u003eIncJob\u003c/code\u003e integer IDs used to reference backup resources.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a request to one of the vulnerable handlers, supplying a manipulated \u003ccode\u003eIncJob\u003c/code\u003e integer ID corresponding to another tenant's backup resource.\u003c/li\u003e\n\u003cli\u003eDepending on the handler targeted, the attacker can:\na. Read sensitive backup metadata from another tenant's account via \u003ccode\u003efetchRestorePoints\u003c/code\u003e.\nb. Irreversibly delete another tenant's backup snapshots via \u003ccode\u003edeleteBackup\u003c/code\u003e.\nc. Trigger an unauthorized restoration of another tenant's backup job via \u003ccode\u003erestorePoint\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eIf the attacker initiates a restoration, the operation is executed with root privileges, potentially leading to system compromise or data overwrites on the victim tenant's environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-65917 allows an authenticated user to gain unauthorized access to, delete, or restore backup resources belonging to other tenants on the same CyberPanel instance. This can lead to severe data breaches, complete data loss for affected tenants due to irreversible deletion of backups, or unauthorized system takeover through malicious restoration processes executing with root privileges. The vulnerability directly impacts data confidentiality, integrity, and availability for all tenants hosted on a vulnerable CyberPanel server. While no specific victim count or targeted sectors are provided, any organization utilizing CyberPanel through version 1.9.1 in a multi-tenant environment is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately patch CyberPanel instances to a version that includes commit b198460 or later to address CVE-2026-65917.\u003c/li\u003e\n\u003cli\u003eReview web server logs for unusual access patterns to the \u003ccode\u003eIncBackups\u003c/code\u003e application endpoints, especially requests containing sequential or non-user-specific \u003ccode\u003eIncJob\u003c/code\u003e integer IDs, which may indicate attempted exploitation of CVE-2026-65917.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized backup deletion or restoration events within CyberPanel's activity logs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T16:22:56Z","date_published":"2026-07-23T16:22:56Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cyberpanel-idor/","summary":"An Insecure Direct Object Reference (IDOR) vulnerability, tracked as CVE-2026-65917, exists in CyberPanel versions through 1.9.1, specifically within the IncBackups application's incremental-backup handlers, allowing authenticated panel users to exploit attacker-controlled IncJob integer IDs to access, read metadata from, delete, or trigger unauthorized restoration of other tenants' backup resources, potentially leading to operations with root privileges.","title":"CyberPanel Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-65917)","url":"https://feed.craftedsignal.io/briefs/2026-07-cyberpanel-idor/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-65916"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CyberPanel (through 1.9.1)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","authorization-bypass","data-destruction","cyberpanel","cve"],"_cs_type":"advisory","_cs_vendors":["usmannasir"],"content_html":"\u003cp\u003eCVE-2026-65916 describes a critical missing authorization vulnerability affecting CyberPanel installations up to version 1.9.1. This flaw, fixed in commit \u003ccode\u003eb198460\u003c/code\u003e, resides within the \u003ccode\u003ecancelBackupCreation\u003c/code\u003e handler, which is intended to manage backup processes. However, due to insufficient authorization checks, any authenticated user can exploit this vulnerability to impact backups belonging to other tenants on the same CyberPanel instance. By sending specially crafted POST requests containing arbitrary \u003ccode\u003ebackupCancellationDomain\u003c/code\u003e and \u003ccode\u003efileName\u003c/code\u003e parameters, attackers can terminate backup processes, delete existing backup archives, corrupt backup status files, and remove corresponding database records for other users. This poses a significant risk of data loss and service disruption for multi-tenant CyberPanel environments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker obtains valid authentication credentials for a low-privileged account on a CyberPanel instance.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP POST request targeting the \u003ccode\u003e/cancelBackupCreation\u003c/code\u003e endpoint of the CyberPanel web interface.\u003c/li\u003e\n\u003cli\u003eThe crafted request includes parameters \u003ccode\u003ebackupCancellationDomain\u003c/code\u003e and \u003ccode\u003efileName\u003c/code\u003e, specifying a target domain and backup file belonging to another tenant.\u003c/li\u003e\n\u003cli\u003eThe CyberPanel application, due to the missing authorization check, processes the request without verifying if the authenticated user has rights to manage backups for the specified \u003ccode\u003ebackupCancellationDomain\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecancelBackupCreation\u003c/code\u003e handler executes internal commands to stop, delete, or corrupt the backup process or files associated with the targeted tenant.\u003c/li\u003e\n\u003cli\u003eThe targeted tenant's backup processes are terminated, their backup archives are deleted, their backup status files become corrupted, and related database records are removed.\u003c/li\u003e\n\u003cli\u003eThis results in significant data loss, unavailability of critical backups, and potential service disruption for the victim tenant.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-65916 can lead to severe consequences, primarily data loss and data unavailability for tenants sharing a CyberPanel installation. Attackers can completely destroy critical backup archives, making recovery from other incidents impossible. This directly impacts data integrity and availability, leading to potential business continuity failures, reputational damage, and financial losses for affected organizations. The vulnerability affects multi-tenant environments where one authenticated user can maliciously impact others.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-65916 by upgrading CyberPanel to a version that includes commit \u003ccode\u003eb198460\u003c/code\u003e or later immediately.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to detect attempts to exploit the \u003ccode\u003ecancelBackupCreation\u003c/code\u003e handler.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003ewebserver\u003c/code\u003e logs for suspicious POST requests to the \u003ccode\u003e/cancelBackupCreation\u003c/code\u003e endpoint, especially those originating from unexpected accounts or specifying domains not owned by the requesting user.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T16:19:01Z","date_published":"2026-07-23T16:19:01Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cyberpanel-auth-bypass/","summary":"A missing authorization vulnerability, identified as CVE-2026-65916, in CyberPanel through version 1.9.1 allows authenticated users to manipulate and destroy other tenants' backups by sending crafted POST requests to the `cancelBackupCreation` handler.","title":"CyberPanel Missing Authorization Vulnerability Allows Cross-Tenant Backup Manipulation","url":"https://feed.craftedsignal.io/briefs/2026-07-cyberpanel-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - CyberPanel (Through 1.9.1)","version":"https://jsonfeed.org/version/1.1"}