Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. (CVE-2026-66797)
Apache CloudStack versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 contain an improper access control vulnerability in the annotation functionality. This flaw allows any authenticated user to create and view annotations/comments on entities they do not own by bypassing ownership checks in the addAnnotation and listAnnotation APIs. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
AI Analysis
Technical Summary
The vulnerability in Apache CloudStack arises from improper enforcement of ownership checks in the addAnnotation and listAnnotation APIs. Although these APIs perform an ownership check when an entity's UUID is specified, they fail to correctly honor the result, enabling any authenticated user to write annotations to and disclose existing annotations on entities they do not own by supplying the entity's UUID. This affects CloudStack versions from 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The issue is addressed in versions 4.20.3.1 and 4.22.1.1 and later.
Potential Impact
Unauthorized users with valid authentication can create annotations and access existing annotations/comments on entities they do not own. This could lead to unauthorized disclosure of information and potential manipulation of annotation data within affected CloudStack environments.
Mitigation Recommendations
Users should upgrade affected Apache CloudStack installations to version 4.20.3.1 or 4.22.1.1 or later, where the issue has been fixed. No other mitigations are indicated by the vendor advisory.
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. (CVE-2026-66797)
Description
Apache CloudStack versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 contain an improper access control vulnerability in the annotation functionality. This flaw allows any authenticated user to create and view annotations/comments on entities they do not own by bypassing ownership checks in the addAnnotation and listAnnotation APIs. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
Affected software
pkg:maven/org.apache.cloudstack/cloudstackRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Apache CloudStack arises from improper enforcement of ownership checks in the addAnnotation and listAnnotation APIs. Although these APIs perform an ownership check when an entity's UUID is specified, they fail to correctly honor the result, enabling any authenticated user to write annotations to and disclose existing annotations on entities they do not own by supplying the entity's UUID. This affects CloudStack versions from 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The issue is addressed in versions 4.20.3.1 and 4.22.1.1 and later.
Potential Impact
Unauthorized users with valid authentication can create annotations and access existing annotations/comments on entities they do not own. This could lead to unauthorized disclosure of information and potential manipulation of annotation data within affected CloudStack environments.
Mitigation Recommendations
Users should upgrade affected Apache CloudStack installations to version 4.20.3.1 or 4.22.1.1 or later, where the issue has been fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6777-p72p-347g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-66797"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a885f22acd9273b493f8054
Added to database: 08/21/2026, 14:22:26 UTC
Last enriched: 08/21/2026, 14:33:41 UTC
Last updated: 08/21/2026, 16:51:58 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.