CVE-2026-66722— Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue
Quick assessment
Affected
Apache Software Foundation Apache CloudStack
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CloudStack 中域管理员对项目角色及项目角色权限的增删改查操作存在权限验证不当漏洞。 域管理员不仅可以对自己所属域中的项目创建、更新、删除和列出项目角色及项目角色权限，还可以对其他域（包括无关域）中的项目进行相同操作。系统仅校验调用者是否为域管理员，而未验证目标项目是否属于该域管理员所属的域或其子域。这使得恶意域管理员能够篡改其他无关域中的项目角色和权限设置。 此问题影响 Apache CloudStack 以下版本：4.15.0.0 至 4.20.3.0，以及 4.21.0.0 至 4.22.1.0。 建
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.15.0.0≤ 4.20.3.0 |
affected |
4.21.0.0≤ 4.22.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66722
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue
Source: CVE Program / CVE List V5
Vulnerability Description
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack.
A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the target project belongs to their domain or subdomain. This allows a malicious Domain Admin to tamper with project roles and permissions across unrelated domains.
This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.15.0.0 ~ 4.20.3.0 | - |
|
II. Public POCs for CVE-2026-66722
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66722
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-66722 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-21 · 21 CVEs total
| CVE-2026-59654 | 6.8 MEDIUM | Apache CloudStack: DoS caused by database connections leak |
| CVE-2026-61397 | Apache CloudStack: OAuth2 Token Cross-Request Leak | |
| CVE-2026-68745 | Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP | |
| CVE-2026-66797 | Apache CloudStack: Unauthorised comment creation and disclosure | |
| CVE-2026-66721 | Apache CloudStack: Authorization issue with listHostTags for domain admins | |
| CVE-2026-65613 | Apache CloudStack: Webhook Deliveries Incorrect Access | |
| CVE-2026-62440 | Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulatio | |
| CVE-2026-61422 | Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate | |
| CVE-2026-61400 | Apache CloudStack: Get and Run Diagnostics Command Injection | |
| CVE-2026-61399 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI | |
| CVE-2026-61398 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Fun | |
| CVE-2026-59799 | Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow | |
| CVE-2026-59780 | Apache CloudStack: LDAP provider configuration disclosure | |
| CVE-2026-59657 | Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob | |
| CVE-2026-59655 | Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure | |
| CVE-2026-59085 | Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module | |
| CVE-2026-50222 | Apache CloudStack: Improper access control in Userdata reference APIs | |
| CVE-2026-50112 | Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates | |
| CVE-2026-47359 | Apache CloudStack: OS Command Injection due to unsanitized mount command | |
| CVE-2026-63046 | Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials |
IV. Related Vulnerabilities
Same product: Apache CloudStack
-
CVE-2026-59654
Apache CloudStack: DoS caused by database connections leak -
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized m -
CVE-2026-50112
Apache CloudStack: RCE and SSRF in direct download, metalink -
CVE-2026-50222
Apache CloudStack: Improper access control in Userdata refer -
CVE-2026-59085
Apache CloudStack: Server-Side Request Forgery (SSRF) vulner
Same vendor: Apache Software Foundation
-
CVE-2026-63041
Apache APISIX: attach-consumer-label does not strip client-s -
CVE-2026-73180
Apache Tomcat: Authenticated WebSocket session survives end -
CVE-2026-68763
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tra -
CVE-2026-68569
Apache Tomcat: Principal lookup can fail open in some cases -
CVE-2026-68525
Apache Tomcat: Redirect after FORM auth may bypass method sp
Same weakness: CWE-285
-
CVE-2026-35445
Winter: Authenticated backend users can bypass Users control -
CVE-2026-70665
Doorkeeper OpenID Connect: DCR endpoint persists unvalidated -
CVE-2026-66422
Apache Tomcat: Servlet role references can bypass declarativ -
CVE-2026-55571
djust authentication bypass: a login_required / on_mount Liv -
CVE-2026-79667
Ech0 before 4.4.3 Authentication Bypass via Scope Enforcemen
V. Comments for CVE-2026-66722
No comments yet