CVE-2026-29200 is an IDOR vulnerability in WebPros Comet Backup that affects versions from 20.11.0 to 26.1.1 and 26.2.1. The flaw allows a tenant administrator to impersonate any end-user account of other tenants on the same server by exploiting a vulnerable API call. This enables unauthorized access across tenant boundaries, violating access controls. The vulnerability has a critical CVSS 4.0 score of 9.9, reflecting its high impact and ease of exploitation without privileges or user interaction. No official patch or remediation information is currently available from the vendor, and no known exploits have been reported in the wild.

Successful exploitation allows a tenant administrator to impersonate any end-user account of other tenants on the same server, potentially leading to unauthorized access to sensitive data and operations across tenant boundaries. This compromises confidentiality and integrity of tenant data within the affected Comet Backup server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict tenant administrator privileges to trusted personnel only and monitor for suspicious activity related to cross-tenant access attempts. Avoid exposing the vulnerable API externally if possible.