Comet Backup CVE-2026-29200

Multi-tenant deployment mode must be enabled on the Comet Backup server instance. The description states a tenant administrator is the threat actor, indicating authenticated access to a tenant admin account is the baseline requirement. However, the CVSS vector PR:N (no privileges required) contradicts this - verification needed whether unauthenticated exploitation is possible or if the vector is misconfigured. The vulnerable API endpoint must be network-accessible to the attacker, which is default in typical Comet Backup deployments. No special product features, non-default configurations, or user interaction (UI:N) are required beyond the fundamental multi-tenant server setup. Exploitation is NOT limited by platform, version-specific features, or complex attack prerequisites - all versions from 20.11.0 to 26.2.1 in multi-tenant mode are vulnerable to the same API flaw.

The risk profile presents conflicting signals requiring careful interpretation. The CVSS 4.0 score of 9.9 (Critical) with vector AV:N/AC:L/PR:N indicates network-exploitable, low-complexity attack requiring no privileges - suggesting unauthenticated exploitation. However, the description explicitly states 'tenant administrator' as the threat actor, implying authenticated access is required, which contradicts PR:N. This discrepancy suggests either the CVSS vector is misconfigured or the vulnerability has multiple exploitation paths. The high confidentiality and integrity impact (VC:H/VI:H) with supplemental availability impact (SA:H) accurately reflects the cross-tenant impersonation capability enabling data theft, modification, and service disruption. No EPSS score is provided, limiting probability assessment. CISA KEV status is not confirmed, suggesting no widespread exploitation detected yet. The vulnerability was reported via HackerOne, indicating responsible disclosure, and a vendor advisory exists at Comet support portal. Real-world risk is EXTREME for multi-tenant deployments - managed service providers using affected versions face complete tenant isolation failure. Single-tenant deployments have reduced but still significant risk if multiple administrative roles exist. The authentication requirement ambiguity MUST be clarified with vendor before deprioritizing patching.

An attacker with tenant administrator credentials (or potentially unauthenticated access if PR:N is accurate) identifies the vulnerable API endpoint through documentation or reconnaissance. They craft API requests manipulating user identifier parameters to reference accounts belonging to other tenants on the same Comet Backup server. Successful exploitation grants full impersonation of the target user, enabling the attacker to access backup data, modify backup policies, restore configurations, or delete backups across tenant boundaries. In a managed service provider scenario, a malicious administrator of one customer tenant could access and exfiltrate backup data from all other customers on the shared infrastructure.