Vulnerability · Published Jul 23, 2026 · Assigned by VulnCheck

CVE-2026-65916CyberPanel Missing Authorization in cancelBackupCreation Handler

High 8.1

In plain English

A high-severity missing authorization in cyberpanel from usmannasir. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 57.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status files, and remove database records belonging to other tenants.

Affected products (as reported)

Vendor	Product	Versions
usmannasir	cyberpanel	0 – through 1.9.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

Researcher Disclosure technical-description, exploit, issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/cyberpanel-missing-authorization-in-cancelbackupcreation-handler third-party-advisory