STACKIT IaaS API suffers from a missing authorization check vulnerability (CVE-2026-39910) that permits authenticated users with low privileges to escalate their access to full organizational control. The flaw exists in the PUT servers service-accounts endpoint, which does not validate the service accounts being attached to virtual machines. Attackers can attach arbitrary, high-privileged service accounts and then query the Instance Metadata Service to obtain OAuth2 tokens. This bypasses tenant isolation and allows unauthorized access to the organization's entire environment. The vulnerability is rated critical with a CVSS 4.0 score of 9.3. No patch or remediation level is currently documented, and the service is not cloud-hosted, so remediation responsibility lies with the vendor and users.

Exploitation of this vulnerability allows an authenticated attacker with low privileges to escalate to full organization compromise by attaching high-privileged service accounts to virtual machines they control. This leads to unauthorized access to OAuth2 tokens via the Instance Metadata Service, effectively bypassing tenant boundaries and enabling control over the entire organizational environment. The impact is critical due to the potential for complete environment takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published, organizations should monitor vendor communications closely. Until a patch is available, restrict access to the affected API endpoints to trusted users only and apply strict access controls to minimize exposure. Avoid granting unnecessary privileges to service accounts and review service account attachments regularly.