CVE-2026-65916: CyberPanel Missing Authorization in cancelBackupCreation Handler
CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status files, and remove database records belonging to other tenants.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CyberPanelto a version that resolves this vulnerability.Fixed in 1.9.1Patch b198460
Event History
Frequently Asked Questions
What is the CVE-2026-65916 vulnerability?
CVE-2026-65916 is a missing authorization vulnerability in the cancelBackupCreation handler of CyberPanel that allows authenticated users to manipulate other tenants' backups.
What is the severity of CVE-2026-65916?
The severity of CVE-2026-65916 is classified as high with a CVSS score of 8.1.
How does CVE-2026-65916 impact CyberPanel users?
CVE-2026-65916 allows attackers to delete, kill, or corrupt backups of other tenants due to the lack of authorization checks.
How do I fix CVE-2026-65916?
To fix CVE-2026-65916, update CyberPanel to version 1.9.1 or later as it includes a patch for this vulnerability.
Who is affected by CVE-2026-65916?
All authenticated users of CyberPanel prior to version 1.9.1 are affected by CVE-2026-65916.