Apache CloudStack CVE-2026-66722

Exploitation requires a valid Domain Admin credential for any domain in the CloudStack installation - this is an authenticated attack (PR:H per CVSS). The target CloudStack instance must host multiple domains with distinct Domain Admin operators, which is the standard multi-tenant deployment model. No special non-default configuration is needed beyond the normal multi-domain setup; the flaw is present in the default Domain Admin role handling for project role APIs. Exploitation is limited by the requirement for a Domain Admin account: unauthenticated attackers and regular users cannot exploit this flaw. Within that constraint, no additional platform-specific feature toggle or non-default setting is required.

The CVSS 3.1 score of 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects network-accessible exploitation with no user interaction, but the PR:H metric is significant: exploitation is gated behind a valid Domain Admin credential, substantially narrowing the realistic attacker pool to insiders or compromised admin accounts. The EPSS score of 0.13% at the 3rd percentile reinforces that mass exploitation is not observed or anticipated. There is no CISA KEV entry and no public exploit code. In practice, this is a privilege-escalation-within-privilege vulnerability relevant primarily in multi-tenant CloudStack deployments where distinct administrative domains are operated by mutually untrusting parties - even a mid-sized municipal IT team in ustka running CloudStack for tenant isolation should treat unauthorized cross-domain role manipulation as a serious integrity risk, since a rogue Domain Admin from one tenant could silently dismantle permission boundaries in another. The CVSS C:H/I:H/A:H impact ratings are plausible given that role and permission deletion can effectively deny access (availability) and that reading role structures may expose organizational access-control design (confidentiality).

An attacker who controls or compromises a Domain Admin account in any domain of a multi-tenant CloudStack deployment can issue standard CloudStack API calls targeting project role endpoints for projects in foreign domains. Because the server-side check does not validate domain membership of the target project, the attacker can silently delete permission grants in a competitor tenant's projects, effectively locking out legitimate users, or inject permissive role assignments to facilitate lateral movement. No exploit code is publicly known at time of analysis, but the flaw requires only standard API interaction.