PT-2026-137163

WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send request...