CVE-2025-66170
Improper Authorization in CloudStack Backup Plugin
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | cloudstack_backup_plugin | 4.21.0.0 |
| apache | cloudstack_backup_plugin | 4.22.0.0 |
| apache | cloudstack_backup_plugin | 4.22.0.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The CloudStack Backup plugin in versions 4.21.0.0 and 4.22.0.0 has an improper authorization logic vulnerability. This means that any authenticated user in a CloudStack environment with this plugin enabled can list backups from any account, even those they do not own.
However, this vulnerability does not allow users to view the actual contents of the backups, only the list of backups.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users with valid accounts to enumerate backups from other accounts within the CloudStack environment. This could lead to information disclosure about the existence and metadata of backups.
Although the contents of the backups are not exposed, knowing which backups exist could aid an attacker in planning further attacks or gaining insights into the environment's backup practices.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users are recommended to upgrade the CloudStack Backup plugin to version 4.22.0.1, which fixes the improper authorization logic issue.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows any authenticated user in CloudStack environments with the affected Backup plugin versions to list backups from any account. Although the contents of the backups cannot be viewed, the ability to enumerate backups across accounts may lead to unauthorized exposure of metadata or account information.
This improper authorization could potentially impact compliance with standards such as GDPR or HIPAA, which require strict controls on access to personal or sensitive data and auditability of access. Unauthorized listing of backups may violate principles of least privilege and data confidentiality.
Users are advised to upgrade to version 4.22.0.1 to remediate this issue and help maintain compliance.