Executive brief
WebVirtCloud is a web-based virtualization management platform that allows administrators to delegate access to virtual machines via permission grants. The platform fails to properly enforce permission flags on read-only user grants, allowing attackers with view-only access to perform privileged actions such as powering off VMs, resetting passwords, installing SSH keys, and managing ISO images. This effectively allows any user with minimal access to gain full control over virtual infrastructure.
Technical details
The vulnerability stems from improper permission validation in the UserInstance grant system, specifically in the get_instance gate which only checks for the existence of a grant but does not validate the permission flags associated with it. Attackers with read-only grants can bypass authorization checks to perform privileged operations including VM power management, password reset, SSH key injection, and ISO image management. The attack requires network access and an authenticated account with at least view-only permissions; no additional user interaction is needed. No patch availability information is provided in the advisory.
Affected products
- retspen WebVirtCloud <UNKNOWN>
Timeline
- 2026-09-16: disclosed