CVE-2026-66797

MediumCVSS 5.4/10Last modified Oct 16, 2026

Description

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.

The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID.

This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Aug 21, 2026
Last modified: Oct 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-667984.3Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-667997.8Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.CVE-2026-668007.5Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.CVE-2026-668019.8Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.CVE-2026-668028.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Health Attestation (DHA) allow CVE-2026-6680310.0Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.CVE-2026-668047.8Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.CVE-2026-668058.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-668065.5Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-668077.8Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-668088.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-668095.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.