Apache CloudStack CVE-2026-65613

Exploitation requires a valid authenticated session on an affected Apache CloudStack instance (4.20.0.0-4.20.3.0 or 4.21.0.0-4.22.1.0) with access to the Webhook module's delivery listing or deletion endpoints. The critical limiting factor is that CloudStack deployments with a single user or where all users share equivalent trust levels present minimal incremental risk - the vulnerability's impact materializes specifically in multi-tenant or multi-user environments where delivery records from different accounts should be isolated. There is no indication of exploitation without prior authentication, and no evidence that the Webhook module is exposed to unauthenticated paths.

No CVSS vector was provided by the reporter, making score-based risk comparison impossible; metrics below are independently assessed. The information disclosure is bounded by the need for authenticated access to CloudStack's management plane - unauthenticated exploitation is not indicated by the description. Real-world risk is elevated in multi-tenant or shared-service provider CloudStack deployments where user isolation is a security boundary, as leaked webhook delivery data could expose another tenant's endpoint credentials or event payloads, enabling lateral movement or credential theft. In single-tenant or tightly access-controlled environments, practical risk is lower. No EPSS data is available, no CISA KEV listing exists, and no public proof-of-concept has been identified - suggesting this is not currently being exploited at scale. The combination of authenticated-access requirement and information-only impact (no code execution) places this in the moderate real-world priority tier despite potential sensitivity of exposed data.

An authenticated CloudStack user with access to the Webhook module invokes the delivery listing API endpoint and receives delivery records scoped to other users or administrative contexts that their authorization level should not permit. The exposed records may include webhook endpoint URLs with embedded authentication tokens or payload content revealing internal event data, which the attacker can use to access external systems or map infrastructure. No public exploit code exists at time of analysis.