Refine your search

2 vulnerabilities found for by retspen

CVE-2026-122224 (GCVE-0-2026-122224)
Vulnerability from cvelistv5
Published
2026-11-04 20:36
Modified
2026-11-04 20:36
Severity ?
7.2 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE
Summary
WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.
References
Impacted products
Vendor Product Version
retspen webvirtcloud Version: bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/retspen/webvirtcloud",
          "product": "webvirtcloud",
          "repo": "https://github.com/retspen/webvirtcloud",
          "vendor": "retspen",
          "versions": [
            {
              "status": "affected",
              "version": "bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-22T14:24:12.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users\u0027 virtual machines and create volumes and domains on any compute host."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:36:57.877Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/retspen/webvirtcloud/issues/689"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c717"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L125-L162"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L174-L183"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/retspen/webvirtcloud"
        },
        {
          "name": "VulnCheck Advisory: WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/webvirtcloud-through-commit-bb920b0-missing-authorization-in-rest-api-migrate-and-create-endpoints"
        }
      ],
      "title": "WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-122224",
    "datePublished": "2026-11-04T20:36:57.877Z",
    "dateReserved": "2026-11-04T20:21:25.191Z",
    "dateUpdated": "2026-11-04T20:36:57.877Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92761 (GCVE-0-2026-92761)
Vulnerability from cvelistv5
Published
2026-09-16 20:32
Modified
2026-09-21 17:48
Severity ?
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Summary
WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the get_instance gate that only checks grant existence.
References
Impacted products
Vendor Product Version
retspen webvirtcloud Version: 1b2da68b2800f94674dd96f4a986cde30ac88280
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92761",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T17:48:35.204918Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T17:48:40.749Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/retspen/webvirtcloud/issues/682"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "webvirtcloud",
          "vendor": "retspen",
          "versions": [
            {
              "status": "affected",
              "version": "1b2da68b2800f94674dd96f4a986cde30ac88280",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-06-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the get_instance gate that only checks grant existence."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:32:28.410Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #682",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/retspen/webvirtcloud/issues/682"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/retspen/webvirtcloud"
        },
        {
          "name": "get_instance checks only that a grant exists, not its flags",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/retspen/webvirtcloud/blob/1b2da68b2800f94674dd96f4a986cde30ac88280/instances/views.py#L316-L330"
        },
        {
          "name": "poweroff authorizes with get_instance alone",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/retspen/webvirtcloud/blob/1b2da68b2800f94674dd96f4a986cde30ac88280/instances/views.py#L356-L363"
        },
        {
          "name": "resizevm_cpu shows the intended is_change enforcement",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/retspen/webvirtcloud/blob/1b2da68b2800f94674dd96f4a986cde30ac88280/instances/views.py#L538-L546"
        },
        {
          "name": "VulnCheck Advisory: WebVirtCloud Missing Authorization on Instance Control Actions",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/webvirtcloud-missing-authorization-on-instance-control-actions"
        }
      ],
      "title": "WebVirtCloud Missing Authorization on Instance Control Actions",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-92761",
    "datePublished": "2026-09-16T20:32:28.410Z",
    "dateReserved": "2026-09-16T19:06:20.513Z",
    "dateUpdated": "2026-09-21T17:48:40.749Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}