CVE-2026-39910

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT...

CVE-2026-39910

STACKIT IaaS API , a cloud infrastructure management interface provided by the German company STACKIT, contains a missing authorization check on the PUT servers service-accounts endpoint. An authenticated, low-privileged attacker can attach arbitrary high-privileged service accounts to virtual ma...

STACKIT IaaS API 安全漏洞

THE STACKIT IaaS API is a cloud infrastructure management interface provided by the German company STACKIT. There is a security vulnerability in THE STACKIT IaaS API. This vulnerability stems from the lack of authorization checks, which may allow authenticated, low-privilege attackers to elevate...