{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/web-panel/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-65917"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CyberPanel (through 1.9.1)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","idor","web-panel","privilege-escalation","data-manipulation","cyberpanel"],"_cs_type":"advisory","_cs_vendors":["CyberPanel"],"content_html":"\u003cp\u003eA critical Insecure Direct Object Reference (IDOR) vulnerability, identified as CVE-2026-65917, affects CyberPanel versions up to and including 1.9.1. This flaw resides within the IncBackups application's incremental-backup handlers, specifically in the \u003ccode\u003edeleteBackup\u003c/code\u003e, \u003ccode\u003efetchRestorePoints\u003c/code\u003e, and \u003ccode\u003erestorePoint\u003c/code\u003e functions. Authenticated CyberPanel users can exploit this by manipulating a globally sequential \u003ccode\u003eIncJob\u003c/code\u003e integer ID, which is not properly re-scoped to the authorized domain. This oversight allows attackers to access or manipulate backup resources belonging to other tenants. The vulnerability enables actions such as enumerating sequential backup IDs to read another tenant's backup metadata, irreversibly deleting backup snapshots, or initiating unauthorized restoration of another tenant's backup job with elevated root privileges. This vulnerability poses a significant risk of data compromise, destruction, and unauthorized system access across multi-tenant CyberPanel deployments. The issue was fixed in commit b198460.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated attacker gains access to a CyberPanel instance.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the vulnerable \u003ccode\u003eIncBackups\u003c/code\u003e application's incremental-backup handlers (e.g., \u003ccode\u003edeleteBackup\u003c/code\u003e, \u003ccode\u003efetchRestorePoints\u003c/code\u003e, \u003ccode\u003erestorePoint\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker observes or infers the globally sequential nature of \u003ccode\u003eIncJob\u003c/code\u003e integer IDs used to reference backup resources.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a request to one of the vulnerable handlers, supplying a manipulated \u003ccode\u003eIncJob\u003c/code\u003e integer ID corresponding to another tenant's backup resource.\u003c/li\u003e\n\u003cli\u003eDepending on the handler targeted, the attacker can:\na. Read sensitive backup metadata from another tenant's account via \u003ccode\u003efetchRestorePoints\u003c/code\u003e.\nb. Irreversibly delete another tenant's backup snapshots via \u003ccode\u003edeleteBackup\u003c/code\u003e.\nc. Trigger an unauthorized restoration of another tenant's backup job via \u003ccode\u003erestorePoint\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eIf the attacker initiates a restoration, the operation is executed with root privileges, potentially leading to system compromise or data overwrites on the victim tenant's environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-65917 allows an authenticated user to gain unauthorized access to, delete, or restore backup resources belonging to other tenants on the same CyberPanel instance. This can lead to severe data breaches, complete data loss for affected tenants due to irreversible deletion of backups, or unauthorized system takeover through malicious restoration processes executing with root privileges. The vulnerability directly impacts data confidentiality, integrity, and availability for all tenants hosted on a vulnerable CyberPanel server. While no specific victim count or targeted sectors are provided, any organization utilizing CyberPanel through version 1.9.1 in a multi-tenant environment is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately patch CyberPanel instances to a version that includes commit b198460 or later to address CVE-2026-65917.\u003c/li\u003e\n\u003cli\u003eReview web server logs for unusual access patterns to the \u003ccode\u003eIncBackups\u003c/code\u003e application endpoints, especially requests containing sequential or non-user-specific \u003ccode\u003eIncJob\u003c/code\u003e integer IDs, which may indicate attempted exploitation of CVE-2026-65917.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized backup deletion or restoration events within CyberPanel's activity logs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T16:22:56Z","date_published":"2026-07-23T16:22:56Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cyberpanel-idor/","summary":"An Insecure Direct Object Reference (IDOR) vulnerability, tracked as CVE-2026-65917, exists in CyberPanel versions through 1.9.1, specifically within the IncBackups application's incremental-backup handlers, allowing authenticated panel users to exploit attacker-controlled IncJob integer IDs to access, read metadata from, delete, or trigger unauthorized restoration of other tenants' backup resources, potentially leading to operations with root privileges.","title":"CyberPanel Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-65917)","url":"https://feed.craftedsignal.io/briefs/2026-07-cyberpanel-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Web-Panel","version":"https://jsonfeed.org/version/1.1"}