WebPros Comet Backup vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting WebPros Comet Backup: 2 record(s), with affected versions and fixes.
CVE-2026-32999
Critical · 9.0
CWE-94 May 28, 2026
Code Injection in WebPros Comet Backup
Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.
CVE-2026-29200
Critical · 9.9
CWE-639 May 4, 2026
WebPros Comet Backup IDOR Enables Cross-Tenant User Impersonation
A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant administrator to impersonate any end-user account of other tenants on the same server via a vulnerable API call.