CVE-2026-50222

Apache CloudStack: Improper access control in Userdata reference APIs

State: Published
Severity: 7.5 High
Published: Aug 21, 2026
Updated: Aug 25, 2026
Reserved: Jun 4, 2026

Description

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.

Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.

This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-862 Missing Authorization
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
Apache CloudStackApache Software Foundation	4.18.0.0 through 4.20.3.0Affected 4.21.0.0 through 4.22.1.0Affected

References

https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbcvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.