CVE-2026-115376

Name of the Vulnerable Software and Affected Versions Incus versions 7.0.1 through 7.0.1 Incus versions 7.2.0 through 7.4.x

Description An authorization bypass allows project-restricted clients to copy volumes by omitting the source.type variable. Attackers can send crafted POST requests to the custom volumes endpoint using a specific source.project to copy and read volumes, snapshots, and configuration from other projects.

Recommendations Update Incus version 7.0.1 to 7.0.2. Update Incus versions 7.2.0 through 7.4.x to 7.5.0.