https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 15:56:42 +0000 https://cve.radiocsirt.org/vuln/cve-2026-65917 <p><strong>Affected:</strong> usmannasir cyberpanel</p> <p>CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application&#39;s incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants&#39; backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant&#39;s backup metadata, irrecoverably delete another tenant&#39;s backup snapshots, or trigger unauthorized restoration of another tenant&#39;s backup job with root privileges.</p> <p><strong>Affected:</strong> usmannasir cyberpanel</p> <p>CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application&#39;s incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants&#39; backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant&#39;s backup metadata, irrecoverably delete another tenant&#39;s backup snapshots, or trigger unauthorized restoration of another tenant&#39;s backup job with root privileges.</p> https://cve.radiocsirt.org/vuln/cve-2026-65917