High severity · published Jul 23, 2026
CVE-2026-65916
CyberPanel Missing Authorization in cancelBackupCreation Handler
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status files, and remove database records belonging to other tenants.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CY
cyberpanel · usmannasir
through 1.9.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-65916
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-65916
github.com
https://github.com/usmannasir/cyberpanel/commit/b1984603f9b0099b39bca46fea176e53b6d4d601
github.com
https://github.com/usmannasir/cyberpanel/issues/1829
www.vulncheck.com
https://www.vulncheck.com/advisories/cyberpanel-missing-authorization-in-cancelbackupcreation-handler
More from cyberpanel
9.8
CVE-2026-67614
CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal
9.1
CVE-2026-41473
CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints
8.8
CVE-2026-71966
CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer
8.8
CVE-2026-71965
CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature
8.8
CVE-2026-65917
CyberPanel IncBackups IDOR via Sequential Backup ID