Which versions of CyberPanel are affected by CVE-2026-65916?

CyberPanel deployments through version 1.9.1 expose a critical multi-tenant isolation flaw allowing any low-privileged authenticated user to destroy, corrupt, or delete backup data belonging to other…

How to fix or mitigate CVE-2026-65916?

Within 24 hours, identify all CyberPanel instances and their versions in use; immediately restrict low-privileged user access to backup endpoints and audit recent backup activity for signs of tampering or unauthorized cancellations. Within 7 days, implement network segmentation of backup endpoints, configure immutable backup storage to prevent deletion or modification, and establish comprehensive audit logging of all backup operations. Within 30 days, monitor vendor communications for patch availability and develop upgrade plan to patched version; conduct forensic analysis of backup integrity during the vulnerability exposure window to detect cross-tenant tampering.

CyberPanel CVE-2026-65916

Q: What is the CVSS score of CVE-2026-65916?

CVE-2026-65916 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-48306 HIGH

Missing Authorization (CWE-862)

2026-07-23 disclosure@vulncheck.com

GHSA-4r84-m75g-p4ww

Authentication Bypass

7.2

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network handler exploitable by any authenticated low-privileged tenant (PR:L, AC:L, UI:N); backups are destroyed and corrupted giving I:H and A:H with no data read (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 16:36 vuln.today

Analysis Generated

Jul 23, 2026 - 16:36 vuln.today

CVE Published

Jul 23, 2026 - 16:17 cve.org

HIGH 7.2

DescriptionCVE.org

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status files, and remove database records belonging to other tenants.

AnalysisAI

Cross-tenant backup tampering in CyberPanel (through 1.9.1) lets an authenticated low-privileged tenant terminate, delete, and corrupt other tenants' backups via the cancelBackupCreation handler. Because the privileged worker acted purely on attacker-supplied backupCancellationDomain and fileName parameters without an ownership check, any logged-in user could send crafted POST requests to kill backup processes, remove backup archives, rewrite status files, and delete database records belonging to other tenants. No public exploit identified at time of analysis, and the flaw is not in CISA KEV.

Technical ContextAI

CyberPanel is an open-source web hosting control panel (built on Python/Django) that manages multi-tenant hosting including website backups. The root cause is CWE-862 (Missing Authorization): the cancelBackupCreation method in backup/backupManager.py invoked a privileged worker that killed a PID, deleted the backup archive, and rewrote the status file using only the caller-supplied domain and fileName, with no verification that the caller owned the domain. The fixing commit (b1984603f9b0099b39bca46fea176e53b6d4d601) adds ACLManager.checkOwnership on backupCancellationDomain and scopes the Backups row lookup with website__domain, and applies analogous domain-scoping fixes to related IncBackups handlers (delete_backup, fetch_restore_points, restore_point) that shared the same tenant-isolation gap.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the code from commit b198460 (b1984603f9b0099b39bca46fea176e53b6d4d601) or upgrade to a CyberPanel build that includes it, and track the vendor's next tagged release for a versioned patch. If you cannot patch immediately on a shared instance, restrict who holds tenant/reseller accounts and audit account provisioning, since exploitation requires an authenticated low-privileged user; consider temporarily limiting or disabling tenant-initiated backup-cancellation and restore-point operations (trade-off: tenants lose self-service backup control and must rely on admins), and monitor backup status files and the Backups/IncJob database records for unexpected deletions or corruption. See the VulnCheck advisory (https://www.vulncheck.com/advisories/cyberpanel-missing-authorization-in-cancelbackupcreation-handler) and issue #1829 for details.