CVE-2026-65917

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant's backup metadata, irrecoverably delete another tenant's backup snapshots, or trigger unauthorized restoration of another tenant's backup job with root privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jul 23, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-659187.1PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_fro CVE-2026-659197.5Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload CVE-2026-65923.5A vulnerability has been found in ComfyUI up to 0.13.0. Affected by this vulnerability is the function getuserdata of the file app/user_mana CVE-2026-659204.3Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that CVE-2026-659218.8A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended b CVE-2026-659225.4An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to rest CVE-2026-659236.8A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, CVE-2026-659246.5JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authentica CVE-2026-659256.5A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.CVE-2026-659263.1An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and vers CVE-2026-659277.5Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the sec CVE-2026-65933.5A vulnerability was found in ComfyUI up to 0.13.0. Affected by this issue is some unknown functionality of the file server.py of the compone