CVE-2026-65917: IDOR exposes cross-tenant backups

CISO Take

CyberPanel's IncBackups feature (deleteBackup, fetchRestorePoints, restorePoint) accepts a globally sequential integer IncJob ID without verifying it belongs to the authenticated tenant's domain, so any logged-in panel user can enumerate IDs and touch other tenants' backup jobs. This matters most on multi-tenant/shared hosting deployments of CyberPanel: an attacker with only a low-privilege account (PR:L, no user interaction, CVSS 8.8) can read another customer's backup metadata, permanently delete their snapshots, or force an unauthorized restore that executes with root privileges. There is no EPSS score, CISA KEV listing, public exploit, or Nuclei template yet, so this is not under active mass exploitation — but the bug is trivial to weaponize (simple ID incrementing) once noticed, which historically has been true for prior CyberPanel IDOR/auth issues. Action: upgrade CyberPanel past the version fixed in commit b198460, and in the interim audit `IncJob` access logs for sequential-ID probing and restrict panel exposure to trusted networks. Note this CVE is tagged 'ml_ui' in our pipeline but CyberPanel is a general-purpose hosting control panel with no inherent AI/ML functionality — treat the AI-relevance as indirect (backup integrity for AI workloads hosted on affected servers), not a direct AI/ML system flaw.

Sources: NVD GitHub Advisory VulnCheck

What is the risk?

High CVSS (8.8) reflects strong confidentiality/integrity/availability impact once exploited, but real-world exploitation likelihood is currently unconfirmed: no EPSS percentile, no CISA KEV entry, no public PoC or scanner template. Attack complexity is low (sequential integer IDs, no special tooling) and privileges required are low (any authenticated tenant), which lowers the bar significantly compared to unauthenticated attacks — the main gating factor is simply having any account on a shared CyberPanel instance. Risk is concentrated in multi-tenant hosting environments; single-tenant/dedicated CyberPanel installs are largely unaffected since there's no 'other tenant' to attack.

How does the attack unfold?

Initial access

Attacker obtains or already holds a low-privilege authenticated account on a shared/multi-tenant CyberPanel instance.

Enumeration

Attacker submits sequential IncJob integer IDs to deleteBackup/fetchRestorePoints/restorePoint to discover backup jobs belonging to other tenants.

IDOR exploitation

Handlers never re-scope the supplied IncJob ID to the caller's own domain, so the attacker's requests against another tenant's ID succeed.

AML.T0049

Impact

Attacker reads another tenant's backup metadata, deletes their snapshots irrecoverably, or triggers an unauthorized restore that executes with root privileges.

Initial access

Attacker obtains or already holds a low-privilege authenticated account on a shared/multi-tenant CyberPanel instance.

Enumeration

Attacker submits sequential IncJob integer IDs to deleteBackup/fetchRestorePoints/restorePoint to discover backup jobs belonging to other tenants.

IDOR exploitation

Handlers never re-scope the supplied IncJob ID to the caller's own domain, so the attacker's requests against another tenant's ID succeed.

AML.T0049

Impact

Attacker reads another tenant's backup metadata, deletes their snapshots irrecoverably, or triggers an unauthorized restore that executes with root privileges.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade CyberPanel to the version containing fix commit b1984603f9b0099b39bca46fea176e53b6d4d601 (patched state; affected through 1.9.1). Until upgraded: restrict CyberPanel admin/API access to trusted IPs or VPN, avoid running untrusted or low-trust tenants on the same instance, and monitor logs for sequential or out-of-range IncJob ID requests against deleteBackup/fetchRestorePoints/restorePoint endpoints as an enumeration indicator. Post-patch, verify that all three handlers now check the requested IncJob ID against the authenticated user's own domain/tenant scope before acting, and review recent backup deletion/restore audit logs for signs of prior abuse.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage DoS API AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.8 - Data for AI systems

Frequently Asked Questions

What is CVE-2026-65917?

CyberPanel's IncBackups feature (deleteBackup, fetchRestorePoints, restorePoint) accepts a globally sequential integer IncJob ID without verifying it belongs to the authenticated tenant's domain, so any logged-in panel user can enumerate IDs and touch other tenants' backup jobs. This matters most on multi-tenant/shared hosting deployments of CyberPanel: an attacker with only a low-privilege account (PR:L, no user interaction, CVSS 8.8) can read another customer's backup metadata, permanently delete their snapshots, or force an unauthorized restore that executes with root privileges. There is no EPSS score, CISA KEV listing, public exploit, or Nuclei template yet, so this is not under active mass exploitation — but the bug is trivial to weaponize (simple ID incrementing) once noticed, which historically has been true for prior CyberPanel IDOR/auth issues. Action: upgrade CyberPanel past the version fixed in commit b198460, and in the interim audit `IncJob` access logs for sequential-ID probing and restrict panel exposure to trusted networks. Note this CVE is tagged 'ml_ui' in our pipeline but CyberPanel is a general-purpose hosting control panel with no inherent AI/ML functionality — treat the AI-relevance as indirect (backup integrity for AI workloads hosted on affected servers), not a direct AI/ML system flaw.

Is CVE-2026-65917 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-65917, increasing the risk of exploitation.

How to fix CVE-2026-65917?

Upgrade CyberPanel to the version containing fix commit b1984603f9b0099b39bca46fea176e53b6d4d601 (patched state; affected through 1.9.1). Until upgraded: restrict CyberPanel admin/API access to trusted IPs or VPN, avoid running untrusted or low-trust tenants on the same instance, and monitor logs for sequential or out-of-range `IncJob` ID requests against deleteBackup/fetchRestorePoints/restorePoint endpoints as an enumeration indicator. Post-patch, verify that all three handlers now check the requested IncJob ID against the authenticated user's own domain/tenant scope before acting, and review recent backup deletion/restore audit logs for signs of prior abuse.

What is the CVSS score for CVE-2026-65917?

CVE-2026-65917 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.51%.

What is the AI security impact?

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.8

What are the technical details?

Original Advisory

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant's backup metadata, irrecoverably delete another tenant's backup snapshots, or trigger unauthorized restoration of another tenant's backup job with root privileges.

Exploitation Scenario

A low-privilege tenant on a shared CyberPanel hosting box logs into their own panel account and begins incrementing/decrementing the IncJob ID parameter sent to fetchRestorePoints. Because the server never checks that the ID belongs to the caller's own domain, the attacker quickly maps out backup jobs belonging to other tenants on the box. They then call deleteBackup with a victim's IncJob ID to irrecoverably wipe that tenant's backup snapshots, or call restorePoint to force a restoration of a victim's backup job — which runs with root privileges and can overwrite or corrupt the victim's live site/files, all without the victim's knowledge or consent.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.