CVE-2026-66721

Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain. This issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc	Mailing List Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cloudstack::::::::
	cpe:2.3:a:apache:cloudstack::::::::

History

16 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Problema de autorización faltante para administradores de dominio en la funcionalidad de listado de etiquetas de host de CloudStack. Los administradores de dominio, por defecto, tienen permiso para llamar a la API listHostTags, pero la API devuelve etiquetas de host para cada host en el entorno sin alcance de dominio. En su lugar, debería restringirse solo a los hosts dedicados al dominio de ese administrador. Este problema afecta a Apache CloudStack: desde 4.12.0.0 hasta 4.20.3.0 y desde 4.21.0.0 hasta 4.22.1.0. Se recomienda a los usuarios actualizar a la versión 4.20.3.1 o 4.22.1.1 o posterior, lo que soluciona el problema.

Information

Published : 2026-08-21 09:16

Updated : 2026-10-16 15:10

NVD link : CVE-2026-66721

Mitre link : CVE-2026-66721

CVE.ORG link : CVE-2026-66721

JSON object : View

Products Affected

apache

cloudstack

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-66721", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66721", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T17:06:26.980322Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache CloudStack", "versions": [{"status": "affected", "version": "4.12.0.0", "versionType": "semver", "lessThanOrEqual": "4.20.3.0"}, {"status": "affected", "version": "4.21.0.0", "versionType": "semver", "lessThanOrEqual": "4.22.1.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-21T09:16:40.327", "references": [{"url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Missing authorization issue for domain admins in CloudStack's host tags listing functionality.\n\n\n\n\nDomain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.\n\n\n\n\nThis issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\n\n\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue."}, {"lang": "es", "value": "Problema de autorizaci\u00f3n faltante para administradores de dominio en la funcionalidad de listado de etiquetas de host de CloudStack.\n\nLos administradores de dominio, por defecto, tienen permiso para llamar a la API listHostTags, pero la API devuelve etiquetas de host para cada host en el entorno sin alcance de dominio. En su lugar, deber\u00eda restringirse solo a los hosts dedicados al dominio de ese administrador.\n\nEste problema afecta a Apache CloudStack: desde 4.12.0.0 hasta 4.20.3.0 y desde 4.21.0.0 hasta 4.22.1.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 4.20.3.1 o 4.22.1.1 o posterior, lo que soluciona el problema."}], "lastModified": "2026-10-16T15:10:00.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B94AB481-FA36-42B7-A8C6-2400BF0BCB63", "versionEndExcluding": "4.20.3.1", "versionStartIncluding": "4.12.0.0"}, {"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D603F400-5DA6-4A5C-BE58-91F137F8983C", "versionEndExcluding": "4.22.1.1", "versionStartIncluding": "4.21.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}