Vulnerabilities CVE-2025-66170

CVE-2025-66170

Medium

Open

TLP:CLEAR

Apache CloudStack: Any user can list backups that they should not have access to

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and has access to specific APIs can list backups from any account in the environment. This vulnerability does not allow them to see the contents of the backup. Users are recommended to upgrade to version 4.22.0.1, which fixes the issue.

Details

CVSS Score: 6.5
EPSS Score ⓘ: 0.49%

39.4th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Confidence: 90%
Published: May 8, 2026
Last Modified: May 9, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.