The vulnerability resides in CyberPanel’s cancelBackupCreation handler where passing arbitrary backupCancellationDomain and fileName values bypasses authorization checks. An authenticated attacker can terminate backup processes, delete backup archives, corrupt status files, and remove database records of other tenants. This flaw is a classic missing‑authorization condition (CWE‑862) that jeopardizes the availability and integrity of backup data.

All installations of CyberPanel version 1.9.1 or earlier made by usmannasir. No specific minor versions are listed, so any build before the commit that fixes the issue is affected.

The CVSS score of 7.2 indicates high severity; exploitation probability is low (EPSS < 1%). The flaw is not included in the CISA KEV catalog. An attacker only needs legitimate credentials to CyberPanel and the ability to issue crafted POST requests, so the attack vector is authenticated. If the attacker controls a tenant account, they can delete or corrupt another tenant’s backups, causing significant data loss or downtime.