https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 10:17:08 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-65917 <p>CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application&#39;s incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants&#39; backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant&#39;s backup metadata, irrecoverably delete another tenant&#39;s backup snapshots, or trigger unauthorized restoration of another tenant&#39;s backup job with root privileges.</p> <p>CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application&#39;s incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants&#39; backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant&#39;s backup metadata, irrecoverably delete another tenant&#39;s backup snapshots, or trigger unauthorized restoration of another tenant&#39;s backup job with root privileges.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-65917 https://vulnerability.circl.lu/vuln/ghsa-947p-2q4v-5rgj <p>CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application&#39;s incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants&#39; backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant&#39;s backup metadata, irrecoverably delete another tenant&#39;s backup snapshots, or trigger unauthorized restoration of another tenant&#39;s backup job with root privileges.</p> <p>CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application&#39;s incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants&#39; backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain. Attackers can enumerate sequential backup IDs to read another tenant&#39;s backup metadata, irrecoverably delete another tenant&#39;s backup snapshots, or trigger unauthorized restoration of another tenant&#39;s backup job with root privileges.</p> https://vulnerability.circl.lu/vuln/ghsa-947p-2q4v-5rgj