Executive brief
Apache CloudStack is an open-source cloud infrastructure platform used to manage virtual machines and cloud resources. A Domain Admin account can improperly modify project roles and permissions across unrelated domains, allowing unauthorized tampering with access controls for cloud projects beyond their administrative scope. This breaks the intended isolation between cloud domains and could enable privilege escalation or lateral movement between isolated cloud environments.
Technical details
The vulnerability is an improper authorization flaw in CloudStack's CRUD operations for project roles and project role permissions. The vulnerable code checks only whether the caller holds a Domain Admin role but fails to verify that the target project belongs to the caller's domain or subdomain. An attacker with Domain Admin privileges can craft requests to create, update, delete, or list project roles and permissions in any domain. Exploitation requires valid Domain Admin credentials and network access to the CloudStack API. Fixes are available in versions 4.20.3.1 and 4.22.1.1 or later.
Affected products
- Apache CloudStack 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0
Timeline
- 2026-08-21: disclosed