🔐 CVE Alert

CVE-2026-122224

HIGH 8.1

WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints

CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th

WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.

CWE CWE-862
Vendor retspen
Product webvirtcloud
Published Nov 4, 2026
Stay Ahead of the Next One

Get instant alerts for retspen webvirtcloud

Be the first to know when new high vulnerabilities affecting retspen webvirtcloud are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Affected Versions

retspen / webvirtcloud
bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/retspen/webvirtcloud/issues/689 github.com: https://github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c717 github.com: https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L125-L162 github.com: https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L174-L183 hackmd.io: https://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create github.com: https://github.com/retspen/webvirtcloud vulncheck.com: https://www.vulncheck.com/advisories/webvirtcloud-through-commit-bb920b0-missing-authorization-in-rest-api-migrate-and-create-endpoints

Credits

hieuPenguinnn