CyberPanel (Through 1.9.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cyberpanel-through-1.9.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 23 Jul 2026 16:22:56 +0000CyberPanel Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-65917)https://feed.craftedsignal.io/briefs/2026-07-cyberpanel-idor/Thu, 23 Jul 2026 16:22:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cyberpanel-idor/An Insecure Direct Object Reference (IDOR) vulnerability, tracked as CVE-2026-65917, exists in CyberPanel versions through 1.9.1, specifically within the IncBackups application's incremental-backup handlers, allowing authenticated panel users to exploit attacker-controlled IncJob integer IDs to access, read metadata from, delete, or trigger unauthorized restoration of other tenants' backup resources, potentially leading to operations with root privileges.A critical Insecure Direct Object Reference (IDOR) vulnerability, identified as CVE-2026-65917, affects CyberPanel versions up to and including 1.9.1. This flaw resides within the IncBackups application's incremental-backup handlers, specifically in the deleteBackup, fetchRestorePoints, and restorePoint functions. Authenticated CyberPanel users can exploit this by manipulating a globally sequential IncJob integer ID, which is not properly re-scoped to the authorized domain. This oversight allows attackers to access or manipulate backup resources belonging to other tenants. The vulnerability enables actions such as enumerating sequential backup IDs to read another tenant's backup metadata, irreversibly deleting backup snapshots, or initiating unauthorized restoration of another tenant's backup job with elevated root privileges. This vulnerability poses a significant risk of data compromise, destruction, and unauthorized system access across multi-tenant CyberPanel deployments. The issue was fixed in commit b198460.

Attack Chain

  1. An authenticated attacker gains access to a CyberPanel instance.
  2. The attacker identifies the vulnerable IncBackups application's incremental-backup handlers (e.g., deleteBackup, fetchRestorePoints, restorePoint).
  3. The attacker observes or infers the globally sequential nature of IncJob integer IDs used to reference backup resources.
  4. The attacker crafts a request to one of the vulnerable handlers, supplying a manipulated IncJob integer ID corresponding to another tenant's backup resource.
  5. Depending on the handler targeted, the attacker can: a. Read sensitive backup metadata from another tenant's account via fetchRestorePoints. b. Irreversibly delete another tenant's backup snapshots via deleteBackup. c. Trigger an unauthorized restoration of another tenant's backup job via restorePoint.
  6. If the attacker initiates a restoration, the operation is executed with root privileges, potentially leading to system compromise or data overwrites on the victim tenant's environment.

Impact

Successful exploitation of CVE-2026-65917 allows an authenticated user to gain unauthorized access to, delete, or restore backup resources belonging to other tenants on the same CyberPanel instance. This can lead to severe data breaches, complete data loss for affected tenants due to irreversible deletion of backups, or unauthorized system takeover through malicious restoration processes executing with root privileges. The vulnerability directly impacts data confidentiality, integrity, and availability for all tenants hosted on a vulnerable CyberPanel server. While no specific victim count or targeted sectors are provided, any organization utilizing CyberPanel through version 1.9.1 in a multi-tenant environment is at risk.

Recommendation

  • Immediately patch CyberPanel instances to a version that includes commit b198460 or later to address CVE-2026-65917.
  • Review web server logs for unusual access patterns to the IncBackups application endpoints, especially requests containing sequential or non-user-specific IncJob integer IDs, which may indicate attempted exploitation of CVE-2026-65917.
  • Monitor for unauthorized backup deletion or restoration events within CyberPanel's activity logs.
]]>criticaladvisoryvulnerabilityidorweb-panelprivilege-escalationdata-manipulationcyberpanelCyberPanel Missing Authorization Vulnerability Allows Cross-Tenant Backup Manipulationhttps://feed.craftedsignal.io/briefs/2026-07-cyberpanel-auth-bypass/Thu, 23 Jul 2026 16:19:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cyberpanel-auth-bypass/A missing authorization vulnerability, identified as CVE-2026-65916, in CyberPanel through version 1.9.1 allows authenticated users to manipulate and destroy other tenants' backups by sending crafted POST requests to the `cancelBackupCreation` handler.CVE-2026-65916 describes a critical missing authorization vulnerability affecting CyberPanel installations up to version 1.9.1. This flaw, fixed in commit b198460, resides within the cancelBackupCreation handler, which is intended to manage backup processes. However, due to insufficient authorization checks, any authenticated user can exploit this vulnerability to impact backups belonging to other tenants on the same CyberPanel instance. By sending specially crafted POST requests containing arbitrary backupCancellationDomain and fileName parameters, attackers can terminate backup processes, delete existing backup archives, corrupt backup status files, and remove corresponding database records for other users. This poses a significant risk of data loss and service disruption for multi-tenant CyberPanel environments.

Attack Chain

  1. An attacker obtains valid authentication credentials for a low-privileged account on a CyberPanel instance.
  2. The attacker crafts an HTTP POST request targeting the /cancelBackupCreation endpoint of the CyberPanel web interface.
  3. The crafted request includes parameters backupCancellationDomain and fileName, specifying a target domain and backup file belonging to another tenant.
  4. The CyberPanel application, due to the missing authorization check, processes the request without verifying if the authenticated user has rights to manage backups for the specified backupCancellationDomain.
  5. The cancelBackupCreation handler executes internal commands to stop, delete, or corrupt the backup process or files associated with the targeted tenant.
  6. The targeted tenant's backup processes are terminated, their backup archives are deleted, their backup status files become corrupted, and related database records are removed.
  7. This results in significant data loss, unavailability of critical backups, and potential service disruption for the victim tenant.

Impact

The successful exploitation of CVE-2026-65916 can lead to severe consequences, primarily data loss and data unavailability for tenants sharing a CyberPanel installation. Attackers can completely destroy critical backup archives, making recovery from other incidents impossible. This directly impacts data integrity and availability, leading to potential business continuity failures, reputational damage, and financial losses for affected organizations. The vulnerability affects multi-tenant environments where one authenticated user can maliciously impact others.

Recommendation

  • Patch CVE-2026-65916 by upgrading CyberPanel to a version that includes commit b198460 or later immediately.
  • Deploy the provided Sigma rule to your SIEM to detect attempts to exploit the cancelBackupCreation handler.
  • Monitor webserver logs for suspicious POST requests to the /cancelBackupCreation endpoint, especially those originating from unexpected accounts or specifying domains not owned by the requesting user.
]]>highadvisoryweb-vulnerabilityauthorization-bypassdata-destructioncyberpanelcve