CVE-2026-29200

published 2026-05-04

CVE-2026-29200: A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant…

Priority P3 57 critical 9.9 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA N SC N SI N SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant administrator to impersonate any end-user account of other tenants on the same server via a vulnerable API call.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
webpros	comet_backup	>= 20.11.0 < 26.1.2	26.1.2
webpros	comet_backup	>= 26.2.0 < 26.2.2	26.2.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-639