CVE-2026-50222

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50222", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-06-04T06:31:36.779Z", "datePublished": "2026-08-21T08:29:17.886Z", "dateUpdated": "2026-08-25T19:34:16.076Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache CloudStack", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "4.20.3.0", "status": "affected", "version": "4.18.0.0", "versionType": "semver"}, {"lessThanOrEqual": "4.22.1.0", "status": "affected", "version": "4.21.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Bernardo De Marco Gon\u00e7alves <bernardomg2004@gmail.com>"}, {"lang": "en", "type": "reporter", "value": "Yuliang Xiao <xyl1509410143@outlook.com>"}, {"lang": "en", "type": "reporter", "value": "\u0141ukasz Bawolski <Lukasz.Bawolski@exea.pl>"}, {"lang": "en", "type": "reporter", "value": "George Chen (GitHub: geo-chen)"}, {"lang": "en", "type": "reporter", "value": "KQ Wu <kqmailbox@163.com>"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.</p><p>Several userdata-related APIs in Apache CloudStack, including <code>deleteUserData</code>, <code>linkUserDataToTemplate</code>, <code>resetUserDataForVirtualMachine</code>, <code>deployVirtualMachine</code>, and <code>updateVirtualMachine</code>, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.</p><p>This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"}], "value": "Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.\n\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.\n\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nThe deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-21T08:29:17.886Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache CloudStack: Improper access control in Userdata reference APIs", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T19:33:56.794540Z", "id": "CVE-2026-50222", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T19:34:16.076Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-50222", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T19:33:56.794540Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T19:34:12.407Z"}}], "cna": {"title": "Apache CloudStack: Improper access control in Userdata reference APIs", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Bernardo De Marco Gon\u00e7alves <bernardomg2004@gmail.com>"}, {"lang": "en", "type": "reporter", "value": "Yuliang Xiao <xyl1509410143@outlook.com>"}, {"lang": "en", "type": "reporter", "value": "\u0141ukasz Bawolski <Lukasz.Bawolski@exea.pl>"}, {"lang": "en", "type": "reporter", "value": "George Chen (GitHub: geo-chen)"}, {"lang": "en", "type": "reporter", "value": "KQ Wu <kqmailbox@163.com>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache CloudStack", "versions": [{"status": "affected", "version": "4.18.0.0", "versionType": "semver", "lessThanOrEqual": "4.20.3.0"}, {"status": "affected", "version": "4.21.0.0", "versionType": "semver", "lessThanOrEqual": "4.22.1.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.\n\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.\n\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nThe deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.</p><p>Several userdata-related APIs in Apache CloudStack, including <code>deleteUserData</code>, <code>linkUserDataToTemplate</code>, <code>resetUserDataForVirtualMachine</code>, <code>deployVirtualMachine</code>, and <code>updateVirtualMachine</code>, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.</p><p>This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-21T08:29:17.886Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50222", "state": "PUBLISHED", "dateUpdated": "2026-08-25T19:34:16.076Z", "dateReserved": "2026-06-04T06:31:36.779Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-08-21T08:29:17.886Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache CloudStack", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "4.20.3.0", "status": "affected", "version": "4.18.0.0", "versionType": "semver"}, {"lessThanOrEqual": "4.22.1.0", "status": "affected", "version": "4.21.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "matchCriteriaId": "2984C5AE-1154-456A-BFF5-067503BBF7D6", "versionEndExcluding": "4.20.3.1", "versionStartIncluding": "4.18.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "matchCriteriaId": "D603F400-5DA6-4A5C-BE58-91F137F8983C", "versionEndExcluding": "4.22.1.1", "versionStartIncluding": "4.21.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.\n\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.\n\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nThe deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue."}, {"lang": "es", "value": "Autorizaci\u00f3n Faltante, Exposici\u00f3n de Informaci\u00f3n Sensible a un Actor No Autorizado vulnerabilidad en las API de referencia de Userdata de Apache CloudStack.\n\nVarias API relacionadas con userdata en Apache CloudStack, incluyendo deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine y updateVirtualMachine, exhiben una validaci\u00f3n de control de acceso faltante o insuficiente, lo que potencialmente permite el acceso entre inquilinos/entre cuentas a recursos de userdata que pertenecen a otros inquilinos.\n\nEste problema afecta a Apache CloudStack: desde 4.18.0.0 hasta 4.20.3.0 y desde 4.21.0.0 hasta 4.22.1.0.\n\nLa API deleteCniConfiguration, introducida en 4.21.0.0, tambi\u00e9n exhibe un comportamiento similar y carece de validaci\u00f3n de acceso.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 4.20.3.1 o 4.22.1.1 o posterior, lo que soluciona el problema."}], "id": "CVE-2026-50222", "lastModified": "2026-10-16T15:10:00.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50222", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T19:33:56.794540Z", "version": "2.0.3"}}]}, "published": "2026-08-21T09:16:38.280", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory", "Mailing List"], "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-862"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.18.0.0,4.20.3.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.21.0.0,4.22.1.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache CloudStack", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "cloudstack", "vendor": "apache"}], "created": "2026-08-21T09:15:05.157261+00:00", "updated": "2026-08-25T22:00:13.436195+00:00", "vendors": ["apache", "apache$PRODUCT$cloudstack"]}