The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can restore a volume from any other user's backups and attach the volume to their own VMs.
Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2026/05/09/3 | Mailing List Third Party Advisory |
Configurations
History
12 May 2026, 13:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm - Mailing List, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/05/09/3 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:* | |
| First Time |
Apache
Apache cloudstack |
10 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
09 May 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 May 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
08 May 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-08 13:16
Updated : 2026-05-12 13:30
NVD link : CVE-2025-66172
Mitre link : CVE-2025-66172
CVE.ORG link : CVE-2025-66172
JSON object : View
Products Affected
apache
- cloudstack
CWE
CWE-359
Exposure of Private Personal Information to an Unauthorized Actor