Apache CloudStack CVE-2026-61399

Exploitation requires two preconditions: first, the attacker must hold a valid (low-privilege) user account in the target Apache CloudStack deployment to inject a payload into a user-controlled attribute; second, a CloudStack administrator must actively invoke the Lock User workflow against that account, triggering the unescaped rendering. Exploitation is constrained by the need for this specific admin action - purely passive or automated network exploitation is not applicable. Authentication requirements for the attacker are inferred as low-privilege authenticated user (no CVSS vector was provided to confirm PR level). What limits exploitation further is that the vulnerable code path is only reached during an explicit administrative operation, not on any routine page load or API call, narrowing the window of opportunity.

No CVSS vector was provided by the Apache reporter, so all metric assessments are independently inferred. Based on CWE-116, the UI context, and the Lock User trigger, this is assessed as a stored XSS requiring low-privilege attacker access and an admin UI interaction - consistent with a CVSS 3.1 Medium (~5.4). EPSS data is unavailable. There is no CISA KEV entry and no confirmed public POC, so no public exploit identified at time of analysis. The real-world risk is moderate: exploitation is gated on an administrator actively using the Lock User function against a user whose data contains an injected payload, eliminating opportunistic or fully automated attacks. However, in multi-tenant cloud environments where untrusted end-users share a CloudStack instance, the risk elevates because the attacker pool is broad and admin actions on user accounts are routine. The Information Disclosure tag from NVD understates the potential impact - successful XSS against an admin session could achieve privilege escalation or unauthorized infrastructure changes, not merely data leakage.

A malicious low-privilege user registers or modifies their CloudStack account so that a user-controlled field (such as a display name) contains a crafted JavaScript payload. When a CloudStack administrator later navigates to the Lock User interface and selects that account, the management UI renders the unescaped field, causing the payload to execute in the administrator's browser session. No public POC has been identified, but the attack is consistent with well-understood stored XSS techniques applicable to any unescaped UI field.