CVE-2026-122224

Deferred Deferred - Pending Action

Missing Authorization in WebVirtCloud Allows VM Takeover

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-122224

EUVD

EUVD-2026-117095

Affected Vendors & Products

Vendor	Product	Version / Range
retspen	webvirtcloud	bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authorization flaw in WebVirtCloud's REST API. Low-privileged authenticated users can access MigrateViewSet and CreateInstanceViewSet endpoints because no permission checks are enforced. Django REST Framework defaults to allowing any authenticated user to interact with these endpoints, enabling attackers to migrate, undefine, or create virtual machines belonging to other users without proper authorization.

Detection Guidance

To detect this vulnerability, check if unauthenticated or low-privileged users can access the /api/v1/migrate/ or compute instance create endpoints. Use curl to test API access: curl -X POST http://<target>/api/v1/migrate/ -H 'Authorization: Bearer <token>' or curl -X POST http://<target>/api/v1/instances/ -H 'Authorization: Bearer <token>'. If responses include unauthorized data or actions, the system is vulnerable.

Impact Analysis

An attacker could exploit this to migrate or delete your virtual machines without permission, create unauthorized VMs on any compute host, or enumerate all VMs on a host to target specific victims. This could lead to data loss, resource exhaustion, or unauthorized access to sensitive operations.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR mandates strict access controls and protection of personal data, while HIPAA requires safeguards for sensitive health information. Unauthorized VM access or manipulation could expose regulated data, leading to legal and regulatory penalties.

Mitigation Strategies

Immediately update WebVirtCloud to the latest commit or apply the security patches from commit 1227674d8f5a5230e5c654267773aca4ebc5c717. Restrict API endpoints to admin-only access by adding permission_classes to MigrateViewSet and CreateInstanceViewSet. Review and enforce tenant isolation for instance management.

Hi! I’m here to help you understand CVE-2026-122224. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...