# CVE-2025-66171: Apache CloudStack improper access control in Backup plugin

Source: https://junglewise.ai/threats/cve-2025-66171-apache-cloudstack-improper-access-control-in-backup-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2025-66171 · Severity: medium · CVSS 6.5 · Published 2026-05-08

Apache CloudStack is an open-source platform used to build and manage large networks of virtual machines. A security flaw in its Backup plugin allows any logged-in user to access and use backups belonging to other users. This could lead to unauthorized data access or the creation of new virtual machines containing sensitive information from other accounts.

Technologies: [Apache Cloudstack](https://junglewise.ai/threats/technologies/cloudstack). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2025-66171 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66171 being exploited in the wild.

**How severe is CVE-2025-66171?** Medium severity, with a CVSS score of 6.5, published 8 May 2026.

**Which products and versions are affected?** Apache CloudStack 4.21.0.0 through 4.22.0.0.

**Is there a fix for CVE-2025-66171?** A patch was published on 2026-05-08: Fixed in version 4.22.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-66171 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-66171?** Check whether you run Apache Cloudstack. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper access control vulnerability (CWE-359) exists in the Apache CloudStack Backup plugin versions 4.21.0.0 and 4.22.0.0. The root cause is flawed access logic within the plugin's API handling. An authenticated attacker with standard user-level access can leverage specific APIs to reference and restore backups that do not belong to their account. This allows the attacker to instantiate new virtual machines based on the disk images of other users, leading to unauthorized disclosure of private data. The issue is resolved in CloudStack version 4.22.0.1.

## Affected products

- Apache CloudStack 4.21.0.0 through 4.22.0.0

## Timeline

- 2026-05-08: disclosed
- 2026-05-08: advisory
- 2026-05-08: patched: Fixed in version 4.22.0.1

## References

- [https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm](https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm)
- [http://www.openwall.com/lists/oss-security/2026/05/09/2](http://www.openwall.com/lists/oss-security/2026/05/09/2)

## Related threats

- [Apache CloudStack resource leak in scoped global configuration](https://junglewise.ai/threats/cve-2026-59654-apache-cloudstack-resource-leak-in-scoped-global-configuration)
- [Apache CloudStack certificate validation bypass in SAML authentication](https://junglewise.ai/threats/cve-2026-68745-apache-cloudstack-certificate-validation-bypass-in-saml)
- [Apache CloudStack improper access control in annotation APIs](https://junglewise.ai/threats/cve-2026-66797-apache-cloudstack-improper-access-control-in-annotation-apis)
- [Apache CloudStack improper authorization in project role management](https://junglewise.ai/threats/cve-2026-66722-apache-cloudstack-improper-authorization-in-project-role)
- [Apache CloudStack authorization bypass in host tags listing](https://junglewise.ai/threats/cve-2026-66721-apache-cloudstack-authorization-bypass-in-host-tags-listing)