https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T22:58:02.415483+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-66171 CVE-2025-66171 — Apache CloudStack: Any user can create a new VM from backups they should not have access to 2026-10-07T22:58:02.431279+00:00

Affected: Apache Software Foundation Apache CloudStack

The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can create new VMs using backups of any other user of the environment.

Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.