PT-2026-36771 · Unknown · Comet Backup

Published 2026-05-04 · Updated 2026-05-15 · CVE-2026-29200

Positive Technologies (AI Summary)

CVSS v4.0

9.9

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Comet Backup versions 20.11.0 through 26.1.1 Comet Backup version 26.2.1

Description An Insecure Direct Object Reference (IDOR)—a flaw where an application provides direct access to objects based on user-supplied input—exists that allows a tenant administrator to impersonate any end-user account belonging to other tenants on the same server through a vulnerable API call.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-29200

Affected Products

Comet Backup

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-29200 · Security Note
• https://support.cometbackup.com/hc/en-us/articles/40090945484823--CVE-2026-29200-%D0%A1ritical-IDOR-vulnerability-in-Comet-Backup · Note
• https://t.me/CVEtracker/52625 · Telegram Post
• https://twitter.com/ADKCyber/status/2055429710578868357 · Twitter Post