Executive brief
Apache CloudStack is a cloud management platform used to orchestrate infrastructure resources. A flaw in its annotation feature allows any authenticated user to create comments and read existing annotations on resources they don't own, potentially exposing sensitive information and enabling unauthorized modifications to shared infrastructure.
Technical details
The vulnerability is an improper access control flaw in the addAnnotation and listAnnotation APIs. These APIs perform an ownership check when an entity UUID is supplied, but fail to correctly honor the result of that check. An authenticated attacker can bypass ownership restrictions by directly supplying a UUID of an entity they don't own, allowing them to both write new annotations/comments and read existing ones. The issue affects CloudStack versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Patches are available in versions 4.20.3.1 and 4.22.1.1 or later.
Affected products
- Apache CloudStack 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0
Timeline
- 2026-08-21: disclosed