{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50222", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-06-04T06:31:36.779Z", "datePublished": "2026-08-21T08:29:17.886Z", "dateUpdated": "2026-08-21T08:29:17.886Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache CloudStack", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "4.20.3.0", "status": "affected", "version": "4.18.0.0", "versionType": "semver"}, {"lessThanOrEqual": "4.22.1.0", "status": "affected", "version": "4.21.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Bernardo De Marco Gon\u00e7alves <[email protected]>"}, {"lang": "en", "type": "reporter", "value": "Yuliang Xiao <[email protected]>"}, {"lang": "en", "type": "reporter", "value": "\u0141ukasz Bawolski <[email protected]>"}, {"lang": "en", "type": "reporter", "value": "George Chen (GitHub: geo-chen)"}, {"lang": "en", "type": "reporter", "value": "KQ Wu <[email protected]>"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.</p><p>Several userdata-related APIs in Apache CloudStack, including <code>deleteUserData</code>, <code>linkUserDataToTemplate</code>, <code>resetUserDataForVirtualMachine</code>, <code>deployVirtualMachine</code>, and <code>updateVirtualMachine</code>, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.</p><p>This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"}], "value": "Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.\n\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.\n\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nThe deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-21T08:29:17.886Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache CloudStack: Improper access control in Userdata reference APIs", "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache CloudStack", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "4.20.3.0", "status": "affected", "version": "4.18.0.0", "versionType": "semver"}, {"lessThanOrEqual": "4.22.1.0", "status": "affected", "version": "4.21.0.0", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.\n\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.\n\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nThe deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue."}], "id": "CVE-2026-50222", "lastModified": "2026-08-21T09:16:38.280", "metrics": {}, "published": "2026-08-21T09:16:38.280", "references": [{"source": "[email protected]", "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-862"}], "source": "[email protected]", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.18.0.0,4.20.3.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.21.0.0,4.22.1.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache CloudStack", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "cloudstack", "vendor": "apache"}], "created": "2026-08-21T09:15:05.157261+00:00", "updated": "2026-08-21T09:30:08.487077+00:00", "vendors": ["apache", "apache$PRODUCT$cloudstack"]}