Authorization bypass of project disk limits in LXD storage volumes (CVE-2026-63299)

LXD contains two code paths that allow an authenticated user to bypass project-level disk and volume quotas. The `storagePoolVolumeTypePostMove` function performs a cross-project volume move without invoking the `AllowVolumeCreation` check, and volume snapshot restore operations skip the `AllowVolumeUpdate` check when the restore request carries no configuration change (`Config == nil`). In multi-tenant LXD clusters, an attacker can exploit these flaws to allocate storage resources exceeding administrative quotas, causing resource exhaustion and denial of service against co-tenants. Affected versions: - >= 5.0, <= 6.9 We recommend updating to: 5.0.8, 5.21.6, 6.10. CVSS 9.9 · our assessment: act_now Reference: https://github.com/canonical/lxd/security/advisories/GHSA-5h78-p252-989h Details: https://vuln.today/cve/CVE-2026-63299