The CloudStack Backup plugin in versions 4.21.0.0 and 4.22.0.0 contains an improper authorization logic vulnerability. Authenticated users with access to specific APIs can list backups from any account in the environment, although they cannot view the backup contents. The issue is fixed in version 4.22.0.1.