CVE-2025-66171
Apache CloudStack: Any user can create a new VM from backups they should not have access to
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can create new VMs using backups of any other user of the environment. Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
| CWE | CWE-359 |
| Vendor | apache software foundation |
| Product | apache cloudstack |
| Published | May 8, 2026 |
| Last Updated | May 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache cloudstack
Be the first to know when new medium vulnerabilities affecting apache software foundation apache cloudstack are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache CloudStack
4.21.0.0 ≤ 4.22.0.0
References
Credits
🔍 Fabricio Duarte <[email protected]> 🔍 Gabriel Ortiga Fernandes <[email protected]> 🔍 Gabriel Pordeus Santos <[email protected]>