Vulnerability-Lookup

GHSA-H5GH-C77H-9PPF

Vulnerability from github – Published: 2026-08-21 09:32 – Updated: 2026-08-21 09:32

Details

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.

Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.

This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-50222"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-21T09:16:38Z",
    "severity": null
  },
  "details": "Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack\u0027s Userdata reference APIs.\n\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.\n\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nThe deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
  "id": "GHSA-h5gh-c77h-9ppf",
  "modified": "2026-08-21T09:32:05Z",
  "published": "2026-08-21T09:32:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50222"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-50222 (GCVE-0-2026-50222)

Vulnerability from cvelistv5 – Published: 2026-08-21 08:29 – Updated: 2026-08-21 08:29

Title

Apache CloudStack: Improper access control in Userdata reference APIs

Summary

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

apache mitre root

References

1 reference

URL	Tags
https://lists.apache.org/thread/g6cwddtjrwbh1d56w…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache CloudStack	Affected: 4.18.0.0 , ≤ 4.20.3.0 (semver) Affected: 4.21.0.0 , ≤ 4.22.1.0 (semver)

Credits

Bernardo De Marco Gonçalves <bernardomg2004@gmail.com> Yuliang Xiao <xyl1509410143@outlook.com> Łukasz Bawolski <Lukasz.Bawolski@exea.pl> George Chen (GitHub: geo-chen) KQ Wu <kqmailbox@163.com>

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache CloudStack",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.20.3.0",
              "status": "affected",
              "version": "4.18.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.22.1.0",
              "status": "affected",
              "version": "4.21.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bernardo De Marco Gon\u00e7alves \u003cbernardomg2004@gmail.com\u003e"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Yuliang Xiao \u003cxyl1509410143@outlook.com\u003e"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "\u0141ukasz Bawolski \u003cLukasz.Bawolski@exea.pl\u003e"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "George Chen (GitHub: geo-chen)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "KQ Wu \u003ckqmailbox@163.com\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack\u0027s Userdata reference APIs.\u003c/p\u003e\u003cp\u003eSeveral userdata-related APIs in Apache CloudStack, including \u003ccode\u003edeleteUserData\u003c/code\u003e, \u003ccode\u003elinkUserDataToTemplate\u003c/code\u003e, \u003ccode\u003eresetUserDataForVirtualMachine\u003c/code\u003e, \u003ccode\u003edeployVirtualMachine\u003c/code\u003e, and \u003ccode\u003eupdateVirtualMachine\u003c/code\u003e, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.\u003c/p\u003e\u003cp\u003eThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\u003c/p\u003e\u003cp\u003eThe deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack\u0027s Userdata reference APIs.\n\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.\n\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nThe deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T08:29:17.886Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache CloudStack: Improper access control in Userdata reference APIs",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-50222",
    "datePublished": "2026-08-21T08:29:17.886Z",
    "dateReserved": "2026-06-04T06:31:36.779Z",
    "dateUpdated": "2026-08-21T08:29:17.886Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-H5GH-C77H-9PPF

CVE-2026-50222 (GCVE-0-2026-50222)

Tags

Sightings

Nomenclature