Vulnerability · Published Jul 23, 2026 · Assigned by VulnCheck

CVE-2026-65917CyberPanel IncBackups IDOR via Sequential Backup ID

High 8.8

In plain English

A high-severity authorization bypass via user-controlled key in cyberpanel from usmannasir. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 56.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant's backup metadata, irrecoverably delete another tenant's backup snapshots, or trigger unauthorized restoration of another tenant's backup job with root privileges.

Affected products (as reported)

Vendor	Product	Versions
usmannasir	cyberpanel	0 – through 1.9.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description, exploit, issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/cyberpanel-incbackups-idor-via-sequential-backup-id third-party-advisory