Search: manila.the

CVE-2026-71195 is a critical authorization vulnerability in OpenStack Manila before version 23.0.1. It allows any authenticated project member to perform unauthorized operations on public shares owned by other tenants. These operations include granting or revoking access, escalating access levels, creating backups to exfiltrate data, deleting or restoring shares, modifying export location metadata, and listing access rules that disclose sensitive information. The flaw arises because the API controllers authorize operations based on the caller's project context but fail to re-authorize against the actual share owner for public shares.