Executive brief
CyberPanel, a popular web hosting control panel, contains a security flaw in its incremental backup system. This vulnerability allows any logged-in user to access, delete, or restore the backups of other customers on the same server. An attacker could use this to permanently destroy a business's data or gain unauthorized access to sensitive files stored in backups.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint). The root cause is that the application performs an ownership check on a user-provided domain but then executes operations using a separate, globally sequential integer ID (IncJob ID) that is not validated against the authorized domain. An authenticated attacker can enumerate these sequential IDs to read metadata, delete backup snapshots, or trigger restorations for any tenant on the system. Destructive operations are executed with root privileges via sudo-mediated restic commands. The issue is fixed in commit b198460 by scoping database lookups to the verified domain.
Affected products
- usmannasir CyberPanel through 1.9.1
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory
- 2026-07-23: patched: Fixed in commit b198460