Vulnerability details

CVE-2026-29200

WebPros Comet Backup

CVSS 4.0

9.9Critical

Official description

A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant administrator to impersonate any end-user account of other tenants on the same server via a vulnerable API call.

CVSS scores

Score	Version	Source	Vector
9.9Critical	4.0	CVEProject cvelistV5 (CNA) (hackerone)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:H`

Affected products

Vendor	Product	Versions	Source
WebPros	Comet Backup	20.11.0 ≤ v < 26.1.2	CVEProject cvelistV5 (CNA)
WebPros	Comet Backup	26.2.0 ≤ v < 26.2.2	CVEProject cvelistV5 (CNA)

References and advisories

https://support.cometbackup.com/hc/en-us/articles/40090945484823--CVE-2026-29200-%D0%A1ritical-IDOR-vulnerability-in-Comet-Backup

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-05-04
Last updated: 2026-05-04
State: Published
Assigner (CNA): hackerone

Exploit prediction (EPSS)

0.29%

Probability of exploitation in 30 days

22.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-639
Insecure Direct Object Reference (IDOR)