A critical Insecure Direct Object Reference (IDOR) vulnerability exists in Comet Backup versions from 20.11.0 through 26.1.1 and 26.2.1. This flaw allows a tenant administrator to impersonate any end-user account belonging to other tenants on the same server by exploiting a vulnerable API call.