Which versions of CyberPanel are affected by CVE-2026-65917?

CyberPanel versions 1.9.1 and earlier allow authenticated users to read, delete, or restore incremental backups belonging to other tenants through predictable parameter enumeration, with no public…

How to fix or mitigate CVE-2026-65917?

Within 24 hours, inventory all CyberPanel instances running version 1.9.1 or earlier and identify those supporting multi-tenant configurations; prioritize internet-facing deployments. Within 7 days, implement network segmentation to restrict authenticated panel access or temporarily disable incremental backup functionality (deleteBackup, fetchRestorePoints, restorePoint endpoints) if operationally feasible; configure audit logging to detect unauthorized backup operations across tenant boundaries. Within 30 days, work with CyberPanel to obtain an official patch or deploy the compensating control disclosed in vendor commit b198460 to re-scope backup operations to authenticated tenant ownership; review backup access logs for evidence of prior cross-tenant access.

CyberPanel CVE-2026-65917

Q: What is the CVSS score of CVE-2026-65917?

CVE-2026-65917 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-48307 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-23 disclosure@vulncheck.com

GHSA-947p-2q4v-5rgj

Authentication Bypass

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable authenticated user (PR:L) with low complexity; read is limited to backup metadata (C:L) while delete and root-privileged restore give I:H/A:H; same security authority so S:U.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 16:35 vuln.today

Analysis Generated

Jul 23, 2026 - 16:35 vuln.today

CVE Published

Jul 23, 2026 - 16:17 cve.org

HIGH 8.7

DescriptionCVE.org

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant's backup metadata, irrecoverably delete another tenant's backup snapshots, or trigger unauthorized restoration of another tenant's backup job with root privileges.

AnalysisAI

Cross-tenant privilege abuse in CyberPanel through 1.9.1 lets any authenticated panel user read, delete, or restore other tenants' incremental backups by supplying a guessed IncJob integer ID that the IncBackups handlers never re-scope to the caller's own domain. The flaw affects the deleteBackup, fetchRestorePoints, and restorePoint endpoints; because IncJob IDs are globally sequential, an attacker can trivially enumerate victims, and unauthorized restores execute with root privileges. No public exploit identified at time of analysis, but the root cause and fix are fully disclosed in vendor commit b198460.

Technical ContextAI

CyberPanel is an open-source web hosting control panel (built on Django/Python) that manages websites, mail, DNS, and backups for many domains under a single multi-tenant installation. The vulnerability is a classic CWE-639 Insecure Direct Object Reference: the IncBackups application performs an ownership check on the user-supplied backup_domain but then loads the backup job with 'IncJob.objects.get(id=backup_id)' using an attacker-controlled integer primary key that is never constrained to the owned domain. Downstream privileged workers (DeleteSnapShot, the restore path) derive their target repository and system user from the IncJob object itself rather than from the validated domain, so passing your own domain alongside another tenant's IncJob ID is enough to act on their data. The fix scopes every lookup to 'website__domain=backup_domain' (and validates JobSnapshots ownership for local restores), closing the gap between the domain-level ACL check and the object-level operation.

RemediationAI

Upgrade to a CyberPanel build that includes commit b1984603f9b0099b39bca46fea176e53b6d4d601, which re-scopes the IncJob and JobSnapshots lookups to the caller's owned domain; this is an upstream fix available as a commit, and a specific tagged patched release is not independently confirmed in the input, so operators tracking releases should apply the commit or the next release incorporating it and verify via the GitHub advisory. If you cannot patch immediately, apply compensating controls: restrict panel account creation and audit existing low-privilege users, since exploitation requires an authenticated account (trade-off: does not stop an already-malicious tenant); place the CyberPanel management interface behind a VPN or IP allowlist to reduce exposure of the vulnerable endpoints (trade-off: no effect on legitimate internal tenants); and monitor application/backup logs for enumeration patterns against IncBackups deleteBackup/fetchRestorePoints/restorePoint and unexpected snapshot deletions or restores (trade-off: detective only, does not prevent the action). See the fix commit and the VulnCheck advisory (https://www.vulncheck.com/advisories/cyberpanel-incbackups-idor-via-sequential-backup-id) for details.