CVE-2026-50222 (GCVE-0-2026-50222)
Vulnerability from cvelistv5
Published
2026-08-21 08:29
Modified
2026-08-25 19:34
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.
Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.
This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache CloudStack |
Version: 4.18.0.0 ≤ 4.20.3.0 Version: 4.21.0.0 ≤ 4.22.1.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-50222",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T19:33:56.794540Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T19:34:16.076Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache CloudStack",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.20.3.0",
"status": "affected",
"version": "4.18.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.22.1.0",
"status": "affected",
"version": "4.21.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Bernardo De Marco Gon\u00e7alves \u003cbernardomg2004@gmail.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Yuliang Xiao \u003cxyl1509410143@outlook.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "\u0141ukasz Bawolski \u003cLukasz.Bawolski@exea.pl\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "George Chen (GitHub: geo-chen)"
},
{
"lang": "en",
"type": "reporter",
"value": "KQ Wu \u003ckqmailbox@163.com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack\u0027s Userdata reference APIs.\u003c/p\u003e\u003cp\u003eSeveral userdata-related APIs in Apache CloudStack, including \u003ccode\u003edeleteUserData\u003c/code\u003e, \u003ccode\u003elinkUserDataToTemplate\u003c/code\u003e, \u003ccode\u003eresetUserDataForVirtualMachine\u003c/code\u003e, \u003ccode\u003edeployVirtualMachine\u003c/code\u003e, and \u003ccode\u003eupdateVirtualMachine\u003c/code\u003e, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.\u003c/p\u003e\u003cp\u003eThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\u003c/p\u003e\u003cp\u003eThe deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack\u0027s Userdata reference APIs.\n\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.\n\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nThe deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T08:29:17.886Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache CloudStack: Improper access control in Userdata reference APIs",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-50222",
"datePublished": "2026-08-21T08:29:17.886Z",
"dateReserved": "2026-06-04T06:31:36.779Z",
"dateUpdated": "2026-08-25T19:34:16.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-50222\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-25T19:33:56.794540Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-25T19:34:12.407Z\"}}], \"cna\": {\"title\": \"Apache CloudStack: Improper access control in Userdata reference APIs\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Bernardo De Marco Gon\\u00e7alves \u003cbernardomg2004@gmail.com\u003e\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Yuliang Xiao \u003cxyl1509410143@outlook.com\u003e\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"\\u0141ukasz Bawolski \u003cLukasz.Bawolski@exea.pl\u003e\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"George Chen (GitHub: geo-chen)\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"KQ Wu \u003ckqmailbox@163.com\u003e\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache CloudStack\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.18.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.20.3.0\"}, {\"status\": \"affected\", \"version\": \"4.21.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.22.1.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack\u0027s Userdata reference APIs.\\n\\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.\\n\\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\\n\\nThe deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.\\n\\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eMissing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack\u0027s Userdata reference APIs.\u003c/p\u003e\u003cp\u003eSeveral userdata-related APIs in Apache CloudStack, including \u003ccode\u003edeleteUserData\u003c/code\u003e, \u003ccode\u003elinkUserDataToTemplate\u003c/code\u003e, \u003ccode\u003eresetUserDataForVirtualMachine\u003c/code\u003e, \u003ccode\u003edeployVirtualMachine\u003c/code\u003e, and \u003ccode\u003eupdateVirtualMachine\u003c/code\u003e, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.\u003c/p\u003e\u003cp\u003eThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\u003c/p\u003e\u003cp\u003eThe deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-08-21T08:29:17.886Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-50222\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-25T19:34:16.076Z\", \"dateReserved\": \"2026-06-04T06:31:36.779Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-08-21T08:29:17.886Z\", \"assignerShortName\": \"apache\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…