EUVD-2026-63832
GHSA-v9cm-qf9w-m6c3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-accessible API requires Domain Admin authentication (PR:H); full CRUD on role data enables confidentiality, integrity, and availability impact with no scope change.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack.
A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the target project belongs to their domain or subdomain. This allows a malicious Domain Admin to tamper with project roles and permissions across unrelated domains.
This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
AnalysisAI
Broken object-level authorization in Apache CloudStack exposes project role management APIs to Domain Admins operating outside their assigned domain scope. Authenticated Domain Admins can create, update, delete, and enumerate project roles and role permissions for projects belonging to entirely unrelated domains, because the authorization check validates only that the caller holds the Domain Admin role without confirming the target project falls within their domain or any subdomain hierarchy. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Domain Admin credential for any domain in the CloudStack installation - this is an authenticated attack (PR:H per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects network-accessible exploitation with no user interaction, but the PR:H metric is significant: exploitation is gated behind a valid Domain Admin credential, substantially narrowing the realistic attacker pool to insiders or compromised admin accounts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The Apache Software Foundation has released patched versions 4.20.3.1 and 4.22.1.1 that correct the object-level authorization check; operators should upgrade to one of these versions or any later release as the primary remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all CloudStack deployments to confirm affected versions (4.15.0.0-4.20.3.0, 4.21.0.0-4.22.1.0) and identify Domain Admin accounts active in production. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Cloudstack
View allCross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes
Two-factor authentication bypass in Apache CloudStack allows an authenticated low-privileged user to exploit an improper
Cross-tenant root command execution in Apache CloudStack (4.14.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0) allows an authenticat
SAML authentication bypass in Apache CloudStack 4.20.3.0 and 4.22.1.0 permits a network-positioned attacker to forge SAM
Authenticated CloudStack users can hijack volumes from other tenants' backups via the Backup plugin in versions 4.21.0.0
Sensitive OAuth configuration data is exposed to unauthenticated remote actors in Apache CloudStack's OAuth authenticati
Sensitive information exposure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration allows u
Missing authorization controls across multiple Userdata-related APIs in Apache CloudStack expose cross-tenant data to an
Server-Side Request Forgery in Apache CloudStack's webhook module lets attackers coerce the management server into issui
Resource exhaustion in Apache CloudStack's scoped global configuration subsystem-spanning versions 4.7.0 through 4.20.3.
Improper access control in the CloudStack Backup plugin allows authenticated users in CloudStack 4.21.0.0 through 4.22.0
Improper authorization logic in the CloudStack Backup plugin allows authenticated users to enumerate backups from any ac
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today