CVE-2026-122224— WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints

Quick assessment

Affected

retspen webvirtcloud

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WebVirtCloud 在提交 bb920b0 中存在一个缺失授权检查的漏洞。由于未声明 permission_classes，Django REST Framework 默认使用 AllowAny，导致低权限的已认证用户可以访问 MigrateViewSet 和 CreateInstanceViewSet。攻击者可以向 /api/v1/migrate/ 或计算实例创建端点发送请求，从而迁移或取消定义其他用户的虚拟机，并在任意计算主机上创建卷和域。

CVSS 8.1 · High Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1055.012 · Process Hollowing T1068.004

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints

Source: CVE Program / CVE List V5

Vulnerability Description

WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.

Source: CVE Program / CVE List V5