The vulnerability is an Insecure Direct Object Reference that lets an authenticated user in CyberPanel’s IncBackups module manipulate backup resources belonging to other tenants by supplying a sequential backup job identifier that is not scoped to the user’s domain. An attacker can read another tenant’s backup metadata, delete their backup snapshots irrecoverably, or trigger a backup restoration that runs with root privileges. This flaw is a classic example of CWE-639, resulting in unauthorized access to sensitive data and the potential for complete system takeover through privileged restoration.

CyberPanel, versions up to 1.9.1 inclusive, are affected. The issue was fixed in commit b198460 of the CyberPanel repository.

The CVSS score of 8.7 indicates a high severity and the EPSS score of less than 1% shows that exploitation probability is low but not zero. Because the flaw requires an authenticated user and sequential ID enumeration, the attack vector is internal but feasible for anyone with panel login credentials. The vulnerability is not present in the CISA KEV catalog, yet the high impact warrants immediate attention. An attacker can exploit IDOR to gain unauthorized restoration privileges, effectively elevating their permissions on the target system.