Incorrect authorization in Apache CloudStack - CVE-2026-66722
Published: August 24, 2026
Vulnerability identifier: #VU144660
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-66722
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify project roles and permissions across unrelated domains.
The vulnerability exists due to improper authorization in ProjectRole and ProjectRolePermission CRUD operations when domain admins target projects outside their domain or subdomain. A remote user can send crafted role management requests to modify project roles and permissions across unrelated domains.
The check verifies only that the caller is a Domain Admin and does not verify whether the target project belongs to the caller's domain or subdomain.
Affected software
Apache CloudStack
How to mitigate CVE-2026-66722
Install security update from vendor's website.
Apache CloudStack - addressed in versions 4.20.3.1, 4.22.1.1