Critical severity · published May 4, 2026
CVE-2026-29200
A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1
9.9
CVSS
0.3%
EPSS
No
On KEV
Description
A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant administrator to impersonate any end-user account of other tenants on the same server via a vulnerable API call.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
Comet Backup · WebPros
20.11.0 before 26.1.2; 26.2.0 before 26.2.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-29200
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-29200
support.cometbackup.com
https://support.cometbackup.com/hc/en-us/articles/40090945484823--CVE-2026-29200-%D0%A1ritical-IDOR-vulnerability-in-Comet-Backup
More from Comet Backup
9.0
CVE-2026-32999
Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a…