CVE-2025-66172
Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can restore a volume from any other user's backups and attach the volume to their own VMs. Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
| CWE | CWE-359 |
| Vendor | apache software foundation |
| Product | apache cloudstack |
| Published | May 8, 2026 |
| Last Updated | May 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache cloudstack
Be the first to know when new medium vulnerabilities affecting apache software foundation apache cloudstack are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache CloudStack
4.21.0.0 ≤ 4.22.0.0
References
Credits
🔍 Gabriel Pordeus