CVE-2025-66170
Apache CloudStack: Any user can list backups that they should not have access to
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and has access to specific APIs can list backups from any account in the environment. This vulnerability does not allow them to see the contents of the backup. Users are recommended to upgrade to version 4.22.0.1, which fixes the issue.
| CWE | CWE-863 |
| Vendor | apache software foundation |
| Product | apache cloudstack |
| Published | May 8, 2026 |
| Last Updated | May 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache cloudstack
Be the first to know when new medium vulnerabilities affecting apache software foundation apache cloudstack are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache CloudStack
4.21.0.0 ≤ 4.22.0.0
References
Credits
🔍 Gabriel Ortiga Fernandes <[email protected]> 🔍 Fabricio Duarte <[email protected]> 🔍 Gabriel Pordeus Santos <[email protected]>