CVE-2025-22828 Apache CloudStack: Unauthorised access to annotations

CloudStack users can add and read comments annotations on resources they are authorised to access. Due to an access validation issue that affects Apache CloudStack versions from 4.16.0, users who have access, prior access or knowledge of resource UUIDs can list and add comments annotations to suc...

CVE-2025-22828

Apache CloudStack versions 4.16.0 and later are affected by a broken access control vulnerability (CWE-200) caused by an access validation issue. This flaw allows users with knowledge of resource UUIDs —which may be exposed in various parts of the application—to list or add comments (annotations)...