CVE-2025-22828

Apache CloudStack versions 4.16.0 and later are affected by a broken access control vulnerability (CWE-200) caused by an access validation issue. This flaw allows users with knowledge of resource UUIDs —which may be exposed in various parts of the application—to list or add comments (annotations)...