CVE-2026-29200 Overview
CVE-2026-29200 is an Insecure Direct Object Reference (IDOR) vulnerability in Comet Backup. The flaw affects all versions from 20.11.0 through 26.1.1 and 26.2.1. A tenant administrator can impersonate any end-user account belonging to other tenants on the same server through a vulnerable API call. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
The vulnerability carries a CVSS 4.0 score of 9.9 and breaks the multi-tenant isolation model that backup-as-a-service deployments rely on. Attackers with low-privileged tenant administrator access can read and modify backup data across tenant boundaries.
Critical Impact
A tenant administrator can impersonate any end-user account on other tenants of the same Comet Backup server, breaking cross-tenant isolation and exposing all customer backup data on the server.
Affected Products
- Comet Backup versions 20.11.0 through 26.1.1
- Comet Backup version 26.2.1
- Multi-tenant Comet Backup server deployments
Discovery Timeline
- 2026-05-04 - CVE-2026-29200 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-29200
Vulnerability Analysis
The vulnerability is an Insecure Direct Object Reference flaw in a Comet Backup API endpoint. The API accepts a user-controlled identifier referencing an end-user account but fails to verify that the requesting tenant administrator owns that account. As a result, the server processes the request and returns a session or context bound to a victim user in a different tenant.
IDOR vulnerabilities in multi-tenant SaaS platforms collapse the trust boundary between tenants. In Comet Backup, that boundary protects backup archives, credentials, storage destinations, and restore operations. Once an attacker impersonates a victim end-user, the attacker inherits that user's data access and operational rights inside the platform.
The issue is exploitable over the network with no user interaction. The attacker only needs valid tenant administrator credentials, which is the normal access level granted to any paying or trial customer of a hosted Comet deployment.
Root Cause
The root cause is missing tenant-scope authorization on a user-impersonation API call. The endpoint trusts the user identifier supplied by the caller instead of constraining lookups to objects owned by the caller's tenant. Comet's advisory confirms the issue is an IDOR pattern mapped to CWE-639.
Attack Vector
An attacker provisions or compromises any tenant administrator account on a vulnerable Comet Backup server. The attacker then issues the affected API request with the user identifier of a target account belonging to a different tenant. The server returns an authenticated context for the victim, granting access to that user's backups, configuration, and storage credentials. Refer to the Comet Backup Security Advisory for vendor-confirmed technical details.
Detection Methods for CVE-2026-29200
Indicators of Compromise
- API requests from a tenant administrator session that reference user identifiers outside that tenant's user namespace.
- Unexpected successful impersonation or session-creation events for end-user accounts initiated by accounts in other tenants.
- Backup job listings, restore operations, or storage credential reads occurring under an end-user identity from an IP address historically associated with a different tenant administrator.
Detection Strategies
- Inspect Comet Backup application logs for impersonation API calls and correlate the calling administrator's tenant ID against the target user's tenant ID. Mismatches are high-fidelity indicators.
- Baseline normal tenant administrator behavior and alert on cross-tenant object references in API parameters.
- Review authentication logs for end-user sessions established without a corresponding interactive login from that user.
Monitoring Recommendations
- Forward Comet Backup access and audit logs to a centralized logging or SIEM platform and retain them for at least 90 days.
- Alert on bulk enumeration of user identifiers by any single tenant administrator account.
- Monitor restore operations and storage destination changes for sudden spikes following the disclosure window of 2026-05-04.
How to Mitigate CVE-2026-29200
Immediate Actions Required
- Upgrade Comet Backup to a fixed release as documented in the Comet Backup Security Advisory.
- Audit all tenant administrator accounts and disable any that are unused, untrusted, or unrecognized.
- Review backup, restore, and storage credential activity since the earliest affected release deployment to identify potential cross-tenant access.
- Rotate storage destination credentials and end-user passwords if cross-tenant access is suspected.
Patch Information
Comet Backup published a security advisory addressing CVE-2026-29200 and instructs administrators to upgrade beyond the affected 20.11.0 through 26.1.1 range and version 26.2.1. Apply the vendor-supplied patched build referenced in the Comet Backup Security Advisory. No public exploit, CISA KEV listing, or in-the-wild exploitation is documented as of 2026-05-06.
Workarounds
- Restrict network access to the Comet Backup management API to trusted administrative networks until patching is complete.
- Limit the number of tenant administrator accounts and enforce strong, unique credentials with multi-factor authentication where supported.
- Segregate high-value customers onto dedicated Comet Backup servers to reduce blast radius from cross-tenant impersonation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
