Webvirtcloud
Monthly
Read-only WebVirtCloud users can escalate to full virtual-machine control because the get_instance authorization gate in instances/views.py only verifies that a UserInstance grant exists and never inspects its permission flags; an authenticated attacker holding a view-only grant can therefore power off VMs, reset root passwords, install attacker-controlled SSH keys, and manage ISO images. The flaw is rated CVSS 8.7 (CVSS 4.0) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires a low-privileged authenticated account with an existing instance grant, no user interaction, and is reachable over the standard web interface. There is no CISA KEV listing and no public exploit code identified at time of analysis, but impact is high-integrity and high-availability for every deployment that delegates instance grants to non-administrative users, such as multi-tenant or team-based installations.
Read-only WebVirtCloud users can escalate to full virtual-machine control because the get_instance authorization gate in instances/views.py only verifies that a UserInstance grant exists and never inspects its permission flags; an authenticated attacker holding a view-only grant can therefore power off VMs, reset root passwords, install attacker-controlled SSH keys, and manage ISO images. The flaw is rated CVSS 8.7 (CVSS 4.0) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires a low-privileged authenticated account with an existing instance grant, no user interaction, and is reachable over the standard web interface. There is no CISA KEV listing and no public exploit code identified at time of analysis, but impact is high-integrity and high-availability for every deployment that delegates instance grants to non-administrative users, such as multi-tenant or team-based installations.