OpenStack Cyborg before version 16.0.1 contains an improper ownership management vulnerability (CWE-282) in its Accelerator Request (ARQ) API. The database does not populate the project_id column, resulting in NULL values for all ARQs. Database queries lack project filtering, and the authorization mechanism is flawed because it compares the caller's project_id against itself instead of the resource's project_id. Consequently, authenticated non-admin users can manipulate ARQs belonging to other tenants, including deleting them, which constitutes a cross-tenant denial of service risk.

The vulnerability allows any authenticated non-admin user to delete Accelerator Requests bound to instances of other projects. This cross-tenant access bypasses intended project ownership restrictions, potentially disrupting services for other tenants by denying access to their resources. The CVSS score of 6.3 reflects a medium severity with impacts on confidentiality, integrity, and availability at a limited scale.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided and the remediation level is unspecified, users should monitor OpenStack advisories for updates. Until a fix is available, restrict access to the Cyborg API to trusted users and consider additional access controls or compensating controls to limit cross-tenant operations.