Improper access control in Apache CloudStack - CVE-2025-66171
Published: May 12, 2026
Vulnerability identifier: #VU131151
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-66171
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to create virtual machines from backups belonging to other accounts.
The vulnerability exists due to improper access control in the CloudStack Backup plugin when handling backup restore API requests. A remote user can call specific APIs to create new virtual machines using backups of other users to create virtual machines from backups belonging to other accounts.
Exploitation requires the backup plugin to be enabled.
Affected software
Apache CloudStack
How to mitigate CVE-2025-66171
Install security update from vendor's website.
Apache CloudStack - update to 4.22.0.1