Threats tagged 'ghsa-7mr3-28h5-m5vx'

LXD contains a vulnerability where missing authorization checks allow an attacker to copy a custom storage volume from a project they do not have access to into a project they control. This occurs because the source project field is attacker-controlled and not properly permission-checked before copying. Exploitation can lead to unauthorized access to secrets stored in custom volumes. A proof-of-concept script demonstrates how an attacker with valid credentials but restricted project access can copy volumes across projects on the same server.