PT-2026-64023 · Unknown · Cyberpanel

George Chen · CVE-2026-65917 · Published 2026-07-23 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CyberPanel versions prior to 1.9.1

Description An insecure direct object reference (IDOR) exists in the IncBackups application's incremental-backup handlers. This occurs because the system uses a globally sequential integer ID for backup jobs without verifying if the requesting user is authorized for that specific domain. Authenticated users can manipulate the IncJob variable to access backup metadata, permanently delete backup snapshots, or trigger unauthorized restoration of backup jobs with root privileges. The affected handlers are deleteBackup(), fetchRestorePoints(), and restorePoint().

Recommendations Update CyberPanel to a version containing commit b198460.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-65917

Affected Products

Cyberpanel

References · 5

• 🔥 https://github.com/usmannasir/cyberpanel/issues/1828 · Exploit
• https://github.com/usmannasir/cyberpanel/commit/b1984603f9b0099b39bca46fea176e53b6d4d601 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-65917 · Security Note
• https://reddit.com/r/pwnhub/comments/1v4uz1y/critical_cyberpanel_vulnerability_allows · Reddit Post
• https://vulncheck.com/advisories/cyberpanel-incbackups-idor-via-sequential-backup-id · Note