CVE-2026-65916 is a missing authorization vulnerability in CyberPanel through version 1.9.1. The issue exists in the cancelBackupCreation handler, which does not properly verify user permissions before processing requests. Authenticated users can exploit this by sending crafted POST requests with arbitrary backupCancellationDomain and fileName parameters, enabling them to kill, delete, and corrupt backups belonging to other tenants. This can disrupt backup integrity and availability. The vulnerability was fixed in commit b198460, though no official patch advisory or remediation level is provided in the data.

An attacker with authenticated access can disrupt backup operations of other tenants by terminating backup processes, deleting backup archives, corrupting backup status files, and removing related database records. This compromises backup availability and integrity for affected tenants, potentially leading to data loss or recovery failures.

A fix for this vulnerability is available in the CyberPanel source code as of commit b198460. Users should upgrade to a version that includes this commit or apply the fix manually. Since no official vendor advisory or patch link is provided, users should monitor the CyberPanel project for official releases containing this fix. Until patched, restrict authenticated user permissions to trusted users only to reduce risk.