The vulnerability CVE-2025-66172 in Apache CloudStack Backup plugin versions 4.21.0.0 and 4.22.0.0 allows any authenticated user with access to certain APIs to restore backup volumes belonging to other users and attach these volumes to their own virtual machines. This is due to improper access logic in the plugin, resulting in exposure of private personal information to unauthorized actors. The vulnerability has a CVSS v3.1 base score of 8.1, indicating high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The confidentiality and integrity impacts are high, while availability is not affected. The vendor recommends upgrading to version 4.22.0.1, which fixes the issue.

An attacker with an authenticated user account and access to specific APIs can access and restore backup volumes from other users, gaining unauthorized access to potentially sensitive data. This compromises confidentiality and integrity of user data within the affected CloudStack environments. There is no impact on availability. No known exploits in the wild have been reported at this time.

Upgrade Apache CloudStack to version 4.22.0.1 or later, which addresses the improper access control in the Backup plugin. Since this is an on-premises product, administrators must apply this update manually. Patch status is not explicitly confirmed in the vendor advisory fields, but the description clearly recommends upgrading to 4.22.0.1 as the fix. No alternative mitigations are indicated.