CVE-2026-122224

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122224", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T20:21:25.191Z", "datePublished": "2026-11-04T20:36:57.877Z", "dateUpdated": "2026-11-09T16:58:51.477Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T20:36:57.877Z"}, "datePublic": "2026-10-22T14:24:12.000Z", "title": "WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints", "descriptions": [{"lang": "en", "value": "WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "affected": [{"vendor": "retspen", "product": "webvirtcloud", "defaultStatus": "unaffected", "versions": [{"version": "bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3", "status": "affected", "versionType": "git"}], "packageURL": "pkg:github/retspen/webvirtcloud", "repo": "https://github.com/retspen/webvirtcloud"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/retspen/webvirtcloud/issues/689", "tags": ["issue-tracking"]}, {"url": "https://github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c717", "tags": ["patch"]}, {"url": "https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L125-L162", "tags": ["technical-description"]}, {"url": "https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L174-L183", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create", "tags": ["technical-description"]}, {"url": "https://github.com/retspen/webvirtcloud", "tags": ["product"]}, {"name": "VulnCheck Advisory: WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/webvirtcloud-through-commit-bb920b0-missing-authorization-in-rest-api-migrate-and-create-endpoints"}], "credits": [{"lang": "en", "value": "hieuPenguinnn", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:09:22.685640Z", "id": "CVE-2026-122224", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:58:51.477Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122224", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T16:09:22.685640Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:09:23.768Z"}}], "cna": {"title": "WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints", "credits": [{"lang": "en", "type": "finder", "value": "hieuPenguinnn"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/retspen/webvirtcloud", "vendor": "retspen", "product": "webvirtcloud", "versions": [{"status": "affected", "version": "bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3", "versionType": "git"}], "packageURL": "pkg:github/retspen/webvirtcloud", "defaultStatus": "unaffected"}], "datePublic": "2026-10-22T14:24:12.000Z", "references": [{"url": "https://github.com/retspen/webvirtcloud/issues/689", "tags": ["issue-tracking"]}, {"url": "https://github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c717", "tags": ["patch"]}, {"url": "https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L125-L162", "tags": ["technical-description"]}, {"url": "https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L174-L183", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create", "tags": ["technical-description"]}, {"url": "https://github.com/retspen/webvirtcloud", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/webvirtcloud-through-commit-bb920b0-missing-authorization-in-rest-api-migrate-and-create-endpoints", "name": "VulnCheck Advisory: WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T20:36:57.877Z"}}}, "cveMetadata": {"cveId": "CVE-2026-122224", "state": "PUBLISHED", "dateUpdated": "2026-11-09T16:58:51.477Z", "dateReserved": "2026-11-04T20:21:25.191Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-04T20:36:57.877Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/retspen/webvirtcloud", "product": "webvirtcloud", "repo": "https://github.com/retspen/webvirtcloud", "vendor": "retspen", "versions": [{"status": "affected", "version": "bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host."}], "id": "CVE-2026-122224", "lastModified": "2026-11-09T17:17:21.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122224", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:09:22.685640Z", "version": "2.0.3"}}]}, "published": "2026-11-04T21:18:10.547", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c717"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/retspen/webvirtcloud"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L125-L162"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L174-L183"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/retspen/webvirtcloud/issues/689"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/webvirtcloud-through-commit-bb920b0-missing-authorization-in-rest-api-migrate-and-create-endpoints"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "webvirtcloud: webvirtcloud: Unauthorized virtual machine manipulation via missing API authorization", "id": "2567846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567846"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-425", "details": ["WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.", "A flaw was found in WebVirtCloud. Missing access controls on virtual machine management endpoints allow authenticated low-privileged users to manipulate or delete virtual machines belonging to other users. By submitting requests directly to unprotected REST API (Application Programming Interface) migration and instance creation endpoints, an attacker can disrupt existing virtual machines and provision unauthorized storage volumes and domains across compute hosts."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122224", "public_date": "2026-11-04T20:36:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122224\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122224\nhttps://github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c717\nhttps://github.com/retspen/webvirtcloud\nhttps://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L125-L162\nhttps://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L174-L183\nhttps://github.com/retspen/webvirtcloud/issues/689\nhttps://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create\nhttps://www.vulncheck.com/advisories/webvirtcloud-through-commit-bb920b0-missing-authorization-in-rest-api-migrate-and-create-endpoints"], "statement": "This vulnerability is rated as Important severity because authenticated users with minimal privileges can remotely compromise virtualization host integrity and disrupt workloads across tenants without requiring administrative access. The flaw allows unauthorized manipulation of guest domains and storage resources across the hypervisor management plane, posing a substantial risk to multi-tenant environments. However, WebVirtCloud is not packaged or distributed within Red Hat Enterprise Linux or other Red Hat products, and standard Red Hat virtualization platforms remain unaffected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "webvirtcloud", "source": "cna", "vendor": "retspen"}, "product": "webvirtcloud", "vendor": "retspen"}], "created": "2026-11-04T21:45:14.731836+00:00", "updated": "2026-11-06T14:45:05.212106+00:00", "vendors": ["retspen", "retspen$PRODUCT$webvirtcloud"]}