CVE-2026-66797: CWE-284 Improper Access Control in Apache Software Foundation Apache CloudStack

The vulnerability arises because the addAnnotation and listAnnotation APIs in Apache CloudStack perform an ownership check when an entity's UUID is specified but fail to enforce the result correctly. This flaw enables any authenticated user to write annotations to and disclose existing annotations on entities they do not own simply by supplying the entity's UUID. The affected versions are from 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The vendor has released fixed versions 4.20.3.1 and 4.22.1.1 to address this issue.

An attacker with authenticated access can bypass intended ownership restrictions to create and view annotations on entities they do not own. This leads to unauthorized disclosure and modification of annotation data, potentially exposing sensitive information or misleading data associated with entities in Apache CloudStack. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impact on confidentiality and integrity but not availability.

Users should upgrade Apache CloudStack to version 4.20.3.1 or 4.22.1.1 or later, where this improper access control vulnerability is fixed. Applying these official fixes is the recommended remediation. No additional mitigations are indicated by the vendor advisory.