CyberRota Analysis
AI-GeneratedCyberPanel versions up to 1.9.1 are vulnerable due to a missing authorization flaw in the cancelBackupCreation handler, allowing authenticated users to manipulate other tenants' backups. This vulnerability enables attackers to terminate backup processes, delete archives, and corrupt associated files by sending specially crafted POST requests. Organizations using CyberPanel should prioritize addressing this issue to protect tenant data integrity and prevent unauthorized access to backup functionalities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status files, and remove database records belonging to other tenants.