Loading story…
CyberPanel fixed two high-severity authorization flaws in versions through 1.9.1 that allowed authenticated users to interfere with backups belonging to other tenants. CVE-2026-65916 exposed the cancelBackupCreation handler to missing authorization checks, enabling crafted POST requests that could terminate another tenant’s backup process, delete backup archives, corrupt backup status files, and remove related database records. The issue is tracked as CWE-862 and was rated CVSS 8.1 under v3.1.
A second flaw, CVE-2026-65917, affected CyberPanel’s incremental backup handlers with a cross-tenant IDOR condition tied to globally sequential IncJob identifiers. Attackers with panel access could enumerate backup IDs to read backup metadata, delete another tenant’s snapshots, or trigger unauthorized restoration of another tenant’s backup job with root-level effects. CyberPanel addressed both issues in commit b1984603f9b0099b39bca46fea176e53b6d4d601 by adding ownership validation and re-scoping lookups for IncJob, JobSnapshots, and Backups records to the authenticated tenant’s domain.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A CyberPanel commit patched multiple cross-tenant authorization and IDOR issues in backup cancellation and incremental backup handlers. The changes added ownership validation and re-scoped backup, job, and snapshot lookups to the authenticated tenant’s domain to prevent unauthorized read, delete, restore, and cancel actions across tenants.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CyberPanel 2.3.6 contained an unauthenticated, zero-click remote code-execution flaw in the `/dataBases/upgrademysqlstatus` endpoint. A user-controlled `statusfile` parameter was concatenated into `sudo cat` and `sudo rm -f` commands, allowing an unauthenticated attacker to execute commands with root privileges. CyberPanel's `secMiddleware` attempted to block malicious POST input, but the endpoint processed request bodies regardless of HTTP method; attackers could use methods such as PUT to bypass the filter. Maintainers were notified and published a patch commit, and the issues were assigned **CVE-2024-51567** and **CVE-2024-51568**. The disclosure also noted a separate prior 2.3.5 File Manager upload weakness in which exception handling could bypass authentication and reach a command-execution sink.
Sep 3, 2026
cPanel released fixes for three vulnerabilities that break tenant isolation on shared-hosting servers. **CVE-2026-87899** allows an authenticated cPanel account holder to escalate privileges and execute code as `root`, potentially taking control of the entire host; **CVE-2026-68490** exposes other accounts’ CalDAV/CardDAV calendar events and contacts through incorrect permissions. Both affect cPanel & WHM version 120 and later. A separate WP Toolkit vulnerability, **CVE-2026-87900**, enables a logged-in cPanel user to modify databases belonging to other cPanel accounts. cPanel has issued fixed builds, but no temporary mitigations were provided for the CalDAV/CardDAV issues and no exploitation has been reported. Administrators should urgently update cPanel/WHM and WP Toolkit, particularly on public multi-tenant deployments, and investigate anomalous cross-account access or database changes.
Sep 24, 2026
WebPros cPanel disclosed and patched a critical authentication bypass flaw in **cPanel & WHM** and **WP Squared**, now tracked as `CVE-2026-41940` with a **CVSS 9.8** score. The bug affects all supported cPanel & WHM versions after `11.40` prior to fixed releases, and reporting indicates some unsupported versions are likely vulnerable as well. Researchers said the issue stems from improper session handling tied to a **CRLF injection** in the login flow, allowing unauthenticated remote attackers to poison session data and gain administrator or root-level access to exposed hosting control panels. cPanel released emergency updates across supported branches, published detection guidance, and advised administrators to force updates, restart `cpsrvd`, and investigate session files and logs for signs of compromise. Multiple sources reported the flaw was **actively exploited in the wild** before patches were issued, with hosting providers such as **Namecheap** and **KnownHost** taking emergency action by restricting access to management ports like `2083` and `2087` while deploying fixes. **CISA** added `CVE-2026-41940` to its **Known Exploited Vulnerabilities** catalog and ordered federal agencies to remediate quickly, while national cyber agencies in Canada, Austria, and Belgium also warned of the risk. Public technical analysis, proof-of-concept code, and exploit tooling released after disclosure increased the likelihood of broad opportunistic attacks against internet-exposed cPanel systems, which researchers estimated number in the hundreds of thousands to more than a million, raising the risk of website compromise, credential theft, ransomware, phishing, and multi-tenant hosting breaches.
Sep 3, 2026