CVE-2026-65916

High

Description

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status files, and remove database records belonging to other tenants.

SeverityHigh

CVSS8.1

Exploit probability—

ProductUsmannasir Cyberpanel

PublishedJul 23, 2026

First seenJul 23, 2026

Weakness typeCWE-862Missing authorization

How to fix

Patches

github.com/usmannasir/cyberpanel/commit/b1984603f9b0099b39bca46fea176e53b6d4d601

Affected products

Product	Affected versions	Fixed in
usmannasir cyberpanel	v ≤ 1.9.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.