CVE-2026-55621: CWE-284: Improper Access Control in lxc incus

The vulnerability arises from missing authorization checks in the storage volume creation handler of incus. Specifically, when copying a custom volume from a source project to a target project, the handler authorizes creation only in the target project but fails to check if the caller has permission to view the source volume. The attacker-controlled field req.Source.Project is used directly without a 'CanView' or equivalent permission check on the source volume. This allows an attacker with limited privileges to copy volumes from projects they do not have access to, potentially exposing sensitive data. The copy must be performed on the same server, but after copying, the volume can be moved elsewhere. A detailed proof-of-concept script is provided, demonstrating how an attacker can exploit this flaw remotely using client certificates.

An attacker with some access to the incus server can copy custom storage volumes from projects they are not authorized to access, potentially leading to disclosure of sensitive information stored in those volumes. The vulnerability does not allow modification or deletion but compromises confidentiality by bypassing access controls on source volumes. The CVSS score of 7.7 reflects a high impact on confidentiality with no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the incus server and carefully manage user permissions and client certificates to prevent unauthorized volume copying. Monitor for updates from the incus project regarding patches addressing this issue.