CVE-2026-66722

Katalog CVE

CVSS 7.2 · High EPSS 0,62%

Kerentanan Improper Authorization pada apache cloudstack. Skor CVSS 3.1 7.2 (High) menurut CISA ADP.

Deskripsi (NVD)

Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the target project belongs to their domain or subdomain. This allows a malicious Domain Admin to tamper with project roles and permissions across unrelated domains. This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Rincian

Terbit di NVD

21 Agustus 2026

Terakhir diubah

27 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc mailing list · advisory vendor