A critical IDOR flaw in Comet Backup lets a tenant administrator impersonate any user belonging to other tenants on the same server via a vulnerable API call. This gives the attacker full access to the impersonated account, potentially exposing confidential data and performing actions as the target user. The weakness is a classic Insecure Direct Object Reference (CWE-639) that allows control over user identities without proper ownership checks.

The vulnerability affects WebPros Comet Backup versions from 20.11.0 through 26.1.1 and 26.2.1. All installations of these releases running on a shared server are vulnerable.

The CVSS score of 9.9 signals a severe risk. The EPSS score is not available, but the lack of public exploitation data does not lessen the theoretical danger. The likely attack path is an authenticated API request performed by a legitimate tenant administrator; the vulnerability does not require additional privileges beyond those normally granted to the admin role. Once exploited, the attacker can impersonate any user across tenants, compromising confidentiality, integrity, and availability of tenant data. The flaw is not listed in the CISA KEV catalog, so monitoring for known exploits is prudent.