A vulnerability in Apache CloudStack involving MinIO bucket policy cleanup allows previous bucket owners to retain access rights after bucket deletion. If a new user creates a bucket with the same name, the former owners can use their old access credentials to gain unauthorized read and write access to the new bucket. This issue is fixed in Apache CloudStack versions 4.20.3.0 and 4.22.0.1 or later.