5.4Medium
CVE-2026-66797Apache CloudStack: Unauthorised comment creation and disclosure
Description
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID. This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Weakness (CWE):
CWE-284
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.16.0.0 – ≤ 4.20.3.0, 4.21.0.0 – ≤ 4.22.1.0 | |
| apache | cloudstack | 4.15.0.0 – < 4.20.3.1 |
References and patches
- https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc vendor-advisoryMailing ListVendor Advisory
CPE matches (NVD) (2)
cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*≥ 4.15.0.0 < 4.20.3.1cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*≥ 4.21.0.0 < 4.22.1.1