CVE-2026-29200CWE-639

A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1

Critical · published May 4, 2026

CVSS v4.0
9.9
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant administrator to impersonate any end-user account of other tenants on the same server via a vulnerable API call.

The record
Technical detail
CVSS v4.0
9.9 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:H
EPSS
0.00460 · 39.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-04T05:42Z
EPSS history
Timeline
  • 04 MAY 05:42Z
    A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1
    cvelistv5