Comet Backup vulnerabilities

2 known vulnerabilities in Comet Backup from WebPros. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.0 Critical severity

  Comet Backup: Improper Control of Generation of Code

  CVE-2026-32999May 28, 2026WebPros

  Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.

• 9.9 Critical severity

  Comet Backup: Authorization Bypass Through User-Controlled Key

  CVE-2026-29200May 4, 2026WebPros

  A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant administrator to impersonate any end-user account of other tenants on the same server via a vulnerable