CVE-2026-66797

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.15.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0

Description Improper access control in the annotation functionality allows authenticated users to create and disclose comments without authorization. The 'addAnnotation' and 'listAnnotation' APIs perform an ownership check when an entity's UUID is specified but do not correctly honor the result. Consequently, any authenticated user can write annotations to or view existing annotations on an entity they do not own by providing its UUID.

Recommendations Upgrade versions 4.15.0.0 through 4.20.3.0 to 4.20.3.1 or later. Upgrade versions 4.21.0.0 through 4.22.1.0 to 4.22.1.1 or later.