{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache CloudStack",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.20.3.0",
              "status": "affected",
              "version": "4.12.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.22.1.0",
              "status": "affected",
              "version": "4.21.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "KQ Wu \u003ckqmailbox@163.com\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eMissing authorization issue for domain admins in CloudStack\u0027s host tags listing functionality.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eDomain Admins, by default, have permission to call the \u003ccode\u003elistHostTags\u003c/code\u003e API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin\u0027s domain.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003eUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue."
            }
          ],
          "value": "Missing authorization issue for domain admins in CloudStack\u0027s host tags listing functionality.\n\n\n\n\nDomain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin\u0027s domain.\n\n\n\n\nThis issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\n\n\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T08:23:00.807Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache CloudStack: Authorization issue with listHostTags for domain admins",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-66721",
    "datePublished": "2026-08-21T08:23:00.807Z",
    "dateReserved": "2026-07-27T15:02:58.111Z",
    "dateUpdated": "2026-08-21T08:23:00.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-66721",
      "date": "2026-08-23",
      "epss": "0.00132",
      "percentile": "0.03236"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-66721\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-08-21T09:16:40.327\",\"lastModified\":\"2026-08-21T09:16:40.327\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Missing authorization issue for domain admins in CloudStack\u0027s host tags listing functionality.\\n\\n\\n\\n\\nDomain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin\u0027s domain.\\n\\n\\n\\n\\nThis issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\\n\\n\\n\\n\\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache CloudStack\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.12.0.0\",\"lessThanOrEqual\":\"4.20.3.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.21.0.0\",\"lessThanOrEqual\":\"4.22.1.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc\",\"source\":\"security@apache.org\"}]}}"
  }
}