CVE-2026-29200: A 9.9 CVSS Comet Backup Flaw Granting Total Cross-Tenant Takeover

Comet Backup disclosed CVE-2026-29200, a critical IDOR in its server API (CVSS 9.9) that can let a tenant administrator impersonate and take over end-user accounts across tenants; the flaw affects roughly six years of releases (notably versions 20.11.0–26.1.1 and 26.2.1), Comet has patched hosted servers and urges self-hosted administrators to update immediately to 26.1.2, 26.2.2 or later, and the issue was responsibly reported by the A Security team.