Executive brief
CyberPanel is a web hosting control panel used to manage websites and servers. A security flaw in the backup management system allows any logged-in user to interfere with the backups of other customers on the same server. An attacker could use this to stop active backup processes, delete existing backup files, or corrupt backup records, potentially leading to permanent data loss for other users.
Technical details
A missing authorization vulnerability (CWE-862) exists in the cancelBackupCreation handler of CyberPanel through version 1.9.1. The application fails to perform ownership checks on the 'backupCancellationDomain' and 'fileName' parameters provided in POST requests. An authenticated attacker can exploit this Insecure Direct Object Reference (IDOR) to terminate backup processes running as root, delete backup archives from the filesystem, and remove corresponding database records belonging to other tenants. The issue was addressed in commit b198460 by implementing ownership verification and scoping database queries to the authenticated user's domain.
Affected products
- usmannasir CyberPanel through 1.9.1
Timeline
- 2026-07-23: advisory: NVD and VulnCheck published the advisory
- 2026-07-23: disclosed
- 2026-07-23: patched: Fixed in commit b198460