PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-65917 usmannasir CVE debrief

CVE-2026-65917 is an insecure direct object reference (IDOR) vulnerability in CyberPanel's IncBackups application, allowing authenticated users to access or manipulate other tenants' backup resources. The vulnerability exists in the incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) and is caused by the use of an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. The vulnerability has a CVSS score of 8.7 and is classified as HIGH.

Vendor
usmannasir
Product
cyberpanel
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-23
Original CVE updated
2026-07-27
Advisory published
2026-07-23
Advisory updated
2026-07-27

Who should care

Administrators and users of CyberPanel, especially those who have installed version 1.9.1 or earlier, should be aware of this vulnerability and take immediate action to patch their systems. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The vulnerability is caused by the use of an attacker-controlled globally sequential IncJob integer ID in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint). This allows authenticated panel users to access or manipulate other tenants' backup resources. The vulnerability has a CVSS score of 8.7 and is classified as HIGH. The vulnerability exists in CyberPanel through 1.9.1, fixed in commit b198460.

Defensive priority

High

Recommended defensive actions

  • Apply the patch provided in commit b198460
  • Restrict access to the IncBackups application
  • Monitor for suspicious activity
  • Implement additional security measures to prevent similar vulnerabilities
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported by Vulncheck and is described in their advisory. The CVE record was published on 2026-07-23T16:17:55.020Z and last modified on 2026-07-27T17:16:40.893Z. The IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) are affected. The vulnerability allows authenticated panel users to access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-65917 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-65917

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-65917 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-65917

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.