Skip to content
fr Sign in
Not rated

CVE-2026-66721 Missing authorization issue for domain admins in CloudStack's host tags listing functionality

Description

Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain. This issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Affected products and versions

Product Affected versions Fixed in
Apache CloudStack 4.21 4.21.0.0 → 4.22.1.0 No fix stated
Apache CloudStack 4.12 4.12.0.0 → 4.20.3.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache CloudStack

The 51 CVEs of Apache CloudStack →
CVE-2026-59654 Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration… 6.8 Medium CVE-2026-47359 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache… Not rated CVE-2026-50112 SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an… Not rated CVE-2026-50222 Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's… Not rated
Track this CVE