CVE-2025-66172

HighCVSS 8.1/10Last modified Oct 7, 2026

Description

The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can restore a volume from any other user's backups and attach the volume to their own VMs.

Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-359

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache CloudStack	>= 4.21.0.0, <= 4.22.0.0

References

https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xmMailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/05/09/3Mailing List, Third Party Advisory

Timeline

Published: May 8, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-661736.2There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the s CVE-2025-661746.8There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for t CVE-2025-661768.8There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an a CVE-2025-661778.8There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an at CVE-2025-661787.2A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 throug CVE-2025-66189.8A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been classified as critical. Affected is the function SetWLanApcliSettings CVE-2025-66199.8A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. Affected by this vulnerability is the function s CVE-2025-661995.9Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without chec CVE-2025-66209.8A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been rated as critical. Affected by this issue is the function setUpgradeUb CVE-2025-662005.4mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directi CVE-2025-662018.1LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (S CVE-2025-662026.5Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass pa