CVE-2026-122224

The WebVirtCloud software (through commit bb920b0 ) is vulnerable to a missing authorization flaw (CWE-862) in its REST API. The vulnerability exists because permission_classes are not declared in the MigrateViewSet and CreateInstanceViewSet, causing the Django REST Framework to default to AllowA...

EUVD-2026-117095

WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permissionclasses are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests...