CVE-2026-50222
Received Received - Intake

Missing Authorization in Apache CloudStack Userdata APIs

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Apache Software Foundation

Description
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-50222
EUVD
EUVD-2026-63846

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache cloudstack From 4.18.0.0 (inc) to 4.20.3.0 (inc)
apache cloudstack From 4.21.0.0 (inc) to 4.22.1.0 (inc)
apache cloudstack 4.20.3.1
apache cloudstack 4.22.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache CloudStack involves missing authorization checks in several userdata-related APIs. These APIs, such as deleteUserData and deployVirtualMachine, fail to properly validate access permissions, allowing unauthorized users to access or manipulate userdata belonging to other tenants or accounts. This could lead to unauthorized data exposure or modification.

Detection Guidance

This vulnerability involves missing authorization checks in Apache CloudStack's userdata APIs. Detection requires reviewing API access logs for unauthorized cross-tenant requests to affected endpoints like deleteUserData, linkUserDataToTemplate, or resetUserDataForVirtualMachine. Check for unusual activity patterns or requests from unexpected sources.

Impact Analysis

If you are using Apache CloudStack versions 4.18.0.0 through 4.20.3.0 or 4.21.0.0 through 4.22.1.0, an attacker could potentially access sensitive userdata from other tenants or accounts. This could result in data breaches, unauthorized modifications, or loss of data integrity.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1, or later to fix the missing authorization and sensitive information exposure issues in userdata APIs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50222. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart