# CVE-2026-65917: CyberPanel IDOR in IncBackups incremental-backup handlers

Source: https://junglewise.ai/threats/cve-2026-65917-cyberpanel-idor-in-incbackups-incremental-backup-handlers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65917 · Severity: high · CVSS 8.8 · Published 2026-07-23

CyberPanel, a popular web hosting control panel, contains a security flaw in its incremental backup system. This vulnerability allows any logged-in user to access, delete, or restore the backups of other customers on the same server. An attacker could use this to permanently destroy a business's data or gain unauthorized access to sensitive files stored in backups.

## Quick answers

**Is CVE-2026-65917 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65917 being exploited in the wild.

**How severe is CVE-2026-65917?** High severity, with a CVSS score of 8.8, published 23 July 2026.

**Which products and versions are affected?** usmannasir CyberPanel through 1.9.1.

**Is there a fix for CVE-2026-65917?** A patch was published on 2026-07-23: Fixed in commit b198460 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65917 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65917?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint). The root cause is that the application performs an ownership check on a user-provided domain but then executes operations using a separate, globally sequential integer ID (IncJob ID) that is not validated against the authorized domain. An authenticated attacker can enumerate these sequential IDs to read metadata, delete backup snapshots, or trigger restorations for any tenant on the system. Destructive operations are executed with root privileges via sudo-mediated restic commands. The issue is fixed in commit b198460 by scoping database lookups to the verified domain.

## Affected products

- usmannasir CyberPanel through 1.9.1

## Timeline

- 2026-07-23: disclosed
- 2026-07-23: advisory
- 2026-07-23: patched: Fixed in commit b198460

## References

- [https://github.com/usmannasir/cyberpanel/commit/b1984603f9b0099b39bca46fea176e53b6d4d601](https://github.com/usmannasir/cyberpanel/commit/b1984603f9b0099b39bca46fea176e53b6d4d601)
- [https://github.com/usmannasir/cyberpanel/issues/1828](https://github.com/usmannasir/cyberpanel/issues/1828)
- [https://www.vulncheck.com/advisories/cyberpanel-incbackups-idor-via-sequential-backup-id](https://www.vulncheck.com/advisories/cyberpanel-incbackups-idor-via-sequential-backup-id)