CVE-2026-65916 is a missing authorization vulnerability in CyberPanel through version 1.9.1. The vulnerability exists in the cancelBackupCreation handler, which does not properly verify that the authenticated user is authorized to cancel or manipulate backups belonging to other tenants. Attackers with authenticated access can send specially crafted POST requests containing arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status files, and remove database records of other tenants. This vulnerability was fixed in commit b198460.

An attacker with authenticated access can disrupt backup operations of other tenants by terminating backup processes, deleting backup archives, corrupting backup status files, and removing database records. This can lead to data loss or backup unavailability for affected tenants. The CVSS 4.0 base score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on integrity and availability.

A fix for this vulnerability is available and was introduced in commit b198460. Users should upgrade CyberPanel to a version that includes this commit or later to remediate the issue. Since no official patch version number is provided, users must verify that their CyberPanel installation includes this fix. Until upgraded, restrict authenticated user permissions to trusted users only to reduce risk.