CVE-2026-66721

Apache CloudStack: Authorization issue with listHostTags for domain admins

State: Published
Severity: 2.7 Low
Published: Aug 21, 2026
Updated: Aug 24, 2026
Reserved: Jul 27, 2026

Description

Missing authorization issue for domain admins in CloudStack's host tags listing functionality.

Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.

This issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	2.7 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
Apache CloudStackApache Software Foundation	4.12.0.0 through 4.20.3.0Affected 4.21.0.0 through 4.22.1.0Affected

References

https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbcvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.