CVE-2026-66797
Received Received - Intake

Improper Access Control in Apache CloudStack Annotation Functionality

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Apache Software Foundation

Description
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID. This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-66797
EUVD
EUVD-2026-63831

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache cloudstack From 4.15.0.0 (inc) to 4.20.3.0 (inc)
apache cloudstack From 4.21.0.0 (inc) to 4.22.1.0 (inc)
apache cloudstack 4.20.3.1
apache cloudstack 4.22.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check but fail to enforce it correctly. This lets any authenticated user write annotations to or disclose existing annotations on entities they do not own by providing the entity's UUID.

Detection Guidance

To detect this vulnerability, check for unauthorized annotations or comments on entities in Apache CloudStack. Review API logs for addAnnotation and listAnnotation calls with UUIDs not owned by the requesting user. Look for unexpected annotation creation or disclosure events.

Impact Analysis

An attacker could create unauthorized comments on resources they do not own or view sensitive comments meant for others. This could lead to data leakage, misinformation, or unauthorized modifications to resource metadata in CloudStack deployments.

Compliance Impact

This vulnerability could violate data protection requirements by allowing unauthorized access to or disclosure of sensitive information stored in annotations. Organizations using CloudStack may face compliance risks under GDPR, HIPAA, or other regulations that mandate strict access controls for sensitive data.

Mitigation Strategies

Immediately upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1, or later to fix the issue. If upgrading is not immediately possible, restrict access to the addAnnotation and listAnnotation APIs until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66797. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart