669 matches found
CVE-2026-66721
Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only t...
CVE-2026-66721
Apache CloudStack versions 4.12.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are vulnerable to a missing authorization issue in the listHostTags API. While Domain Admins are permitted to call this API, it fails to apply domain scoping, returning host tags for every host in the entire enviro...
CVE-2026-66721 Apache CloudStack: Authorization issue with listHostTags for domain admins
Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only t...
CVE-2026-66721 Apache CloudStack: Authorization issue with listHostTags for domain admins
Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only t...
EUVD-2026-63833
Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only t...
CVE-2026-66721 Apache CloudStack: Authorization issue with listHostTags for domain admins
Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only t...
CVE-2026-66722
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...
CVE-2026-66722 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...
CVE-2026-66722
Apache CloudStack versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are vulnerable to an improper authorization flaw during CRUD operations on Project Roles and Project Role permissions. The system verifies that a caller is a Domain Admin but fails to validate whether the target pr...
EUVD-2026-63832
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...
CVE-2026-66722 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...
CVE-2026-66722 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...
CVE-2026-66797
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...
CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...
CVE-2026-66797
Apache CloudStack versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are vulnerable to an improper access control flaw in the annotation functionality . The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is provided but fail to honor the resul...
CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...
EUVD-2026-63831
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...
CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...
CVE-2026-68745
Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the...
CVE-2026-68745
Apache CloudStack versions 4.20.3.0 and 4.22.1.0 are vulnerable to certificate validation failures within the SAML authentication process. This flaw allows a malicious agent to forge a SAML response to the management server by either spoofing the Identity Provider (IdP) IP address or registering ...