PT-2026-64022 · Unknown · Cyberpanel
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
CyberPanel versions prior to 1.9.1 commit b198460
Description
An authorization flaw exists in the
cancelBackupCreation handler. Authenticated users can exploit this by sending crafted POST requests to terminate backup processes, delete backup archives, corrupt backup status files, and remove database records belonging to other tenants. This is achieved by manipulating the backupCancellationDomain and fileName parameters.Recommendations
Update CyberPanel to the version containing commit b198460.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cyberpanel