CVE-2025-66170

MEDIUM

Apache CloudStack: Any user can list backups that they should not have access to

Title source: cna
STIX 2.1

Description

The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and has access to specific APIs can list backups from any account in the environment. This vulnerability does not allow them to see the contents of the backup. Users are recommended to upgrade to version 4.22.0.1, which fixes the issue.

References (2)

Core 2

Scores

CVSS v3 6.5
EPSS 0.0002
EPSS Percentile 4.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (2)
apache/cloudstack 4.21.0.0 - 4.22.0.1
Apache Software Foundation/Apache CloudStack 4.21.0.0 - 4.22.0.0
Published May 08, 2026
Tracked Since May 08, 2026