A vulnerability in Apache CloudStack's Proxmox extension allows unauthorized cross-tenant access to virtual machines. The issue arises because the proxmox_vmid instance setting, which associates CloudStack instances with Proxmox VMs, is user-editable and not validated against tenant ownership. This enables attackers to manipulate this setting to control VMs belonging to other tenants. The vulnerability affects versions from 4.21.0.0 through 4.22.0.0. Upgrading to version 4.22.0.1 mitigates the issue. A workaround is to prevent users from editing the proxmox_vmid instance detail via a global configuration parameter.