CVE Intelligence
Analysis AI-assisted

CVE-2026-29200: WebPros Comet Backup IDOR Enables Cross-Tenant User Impersonation

CVE-2026-29200 is a critical insecure direct object reference (IDOR) flaw in WebPros Comet Backup, with a CVSS v4.0 base score of 9.9 listed in the record. According to the record, a tenant administrator can impersonate end-user accounts of other tenants on the same server through a vulnerable API call. The sources consulted show no KEV listing and no confirmed active exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-29200 is a critical insecure direct object reference (IDOR) issue in WebPros Comet Backup, classified under CWE-639. According to the record, a tenant administrator can reach end-user accounts that belong to other tenants on the same server through a vulnerable API call, which suggests the server does not verify that the requested object belongs to the caller's tenant.

Impact

  • The record describes impersonation of end-user accounts across tenant boundaries on a shared server.
  • The CVSS v4.0 vector in the record indicates high impact on confidentiality and integrity of the vulnerable system, and high impact on a subsequent system. The listed base score is 9.9.
  • Practical consequences depend on how the product uses impersonated sessions, which the record does not describe.

Affected products and versions

  • Product: WebPros Comet Backup.
  • Affected ranges listed in the record: from 20.11.0 up to but not including 26.1.2, and from 26.2.0 up to but not including 26.2.2.
  • The description names all versions from 20.11.0 to 26.1.1 and 26.2.1, which matches the ranges above.
  • The record contains no fixed version entries. Check the vendor support article linked in the references before choosing an upgrade target.

Exploitation status

  • The record does not show this CVE in the CISA KEV catalog.
  • No confirmed active exploitation appears in the sources consulted.
  • SSVC exploitation is recorded as none, and automatable as yes.
  • The EPSS probability is 0.0046 with a percentile of 0.38178, as recorded on 2026-10-13. EPSS estimates likelihood of exploitation and does not confirm that exploitation has occurred.

Remediation and mitigation

  • Identify all Comet Backup deployments and compare their versions with the affected ranges above.
  • Plan an upgrade to a version outside the affected ranges, following vendor guidance. Confirm the exact fixed version with the vendor, since the record does not state it.
  • Until patched, limit tenant administrator accounts to the minimum needed and review who holds that role on shared servers.
  • Restrict access to the management API to trusted administrative networks where operationally feasible.
  • Review tenant isolation assumptions with the vendor and against your own configuration.

Detection guidance

  • Review audit and authentication logs for sessions where an administrator acts under an end-user identity, especially identities belonging to other tenants.
  • Look for administrative API activity that references objects outside the caller's own tenant.
  • Correlate unusual account context switches with change tickets and known administrator activity.
  • Retain logs from before patching so that a later review remains possible.

Limitations of the available information

  • The record has no English title, so the title here is derived from the description.
  • No fixed versions are listed, and the vendor advisory text is not included in the record.
  • The vector sets privileges required to none, while the description requires a tenant administrator. The record does not explain this difference, so the actual prerequisites are unclear.
  • Technical details of the vulnerable API call are not provided, and this analysis does not describe them.
  • Information may change as the vendor and CNA update their records.

Frequently asked questions

Which versions of Comet Backup are affected?

The record lists versions from 20.11.0 up to but not including 26.1.2, and from 26.2.0 up to but not including 26.2.2. The description names 26.1.1 and 26.2.1 as the last affected versions in those ranges.

Is this vulnerability known to be exploited?

The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted. This may change, so check current sources.

What should administrators do now?

Inventory your deployments, compare versions with the listed ranges, follow the vendor guidance for upgrading, and reduce tenant administrator access until a fixed version is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.