# CVE-2026-65916: CyberPanel missing authorization in cancelBackupCreation handler

Source: https://junglewise.ai/threats/cve-2026-65916-cyberpanel-missing-authorization-in-cancelbackupcreation-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65916 · Severity: high · CVSS 8.1 · Published 2026-07-23

CyberPanel is a web hosting control panel used to manage websites and servers. A security flaw in the backup management system allows any logged-in user to interfere with the backups of other customers on the same server. An attacker could use this to stop active backup processes, delete existing backup files, or corrupt backup records, potentially leading to permanent data loss for other users.

## Quick answers

**Is CVE-2026-65916 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65916 being exploited in the wild.

**How severe is CVE-2026-65916?** High severity, with a CVSS score of 8.1, published 23 July 2026.

**Which products and versions are affected?** usmannasir CyberPanel through 1.9.1.

**Is there a fix for CVE-2026-65916?** A patch was published on 2026-07-23: Fixed in commit b198460 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65916 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65916?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in the cancelBackupCreation handler of CyberPanel through version 1.9.1. The application fails to perform ownership checks on the 'backupCancellationDomain' and 'fileName' parameters provided in POST requests. An authenticated attacker can exploit this Insecure Direct Object Reference (IDOR) to terminate backup processes running as root, delete backup archives from the filesystem, and remove corresponding database records belonging to other tenants. The issue was addressed in commit b198460 by implementing ownership verification and scoping database queries to the authenticated user's domain.

## Affected products

- usmannasir CyberPanel through 1.9.1

## Timeline

- 2026-07-23: advisory: NVD and VulnCheck published the advisory
- 2026-07-23: disclosed
- 2026-07-23: patched: Fixed in commit b198460

## References

- [https://github.com/usmannasir/cyberpanel/commit/b1984603f9b0099b39bca46fea176e53b6d4d601](https://github.com/usmannasir/cyberpanel/commit/b1984603f9b0099b39bca46fea176e53b6d4d601)
- [https://github.com/usmannasir/cyberpanel/issues/1829](https://github.com/usmannasir/cyberpanel/issues/1829)
- [https://www.vulncheck.com/advisories/cyberpanel-missing-authorization-in-cancelbackupcreation-handler](https://www.vulncheck.com/advisories/cyberpanel-missing-authorization-in-cancelbackupcreation-handler)