Description

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID. This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-21T09:16:40.577Z",
  "pubdate": "2026-08-21T09:16:40.577Z",
  "executiveSummary": "An improper access control vulnerability has been identified within Apache CloudStack's annotation functionality, specifically affecting the addAnnotation and listAnnotation APIs.\nThis security flaw allows any authenticated user to bypass ownership verification checks and unlawfully create, write, or disclose existing annotations and comments on entities they do not own simply by supplying the target entity's UUID.\nThe vulnerability impacts Apache CloudStack versions from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\nThe risk implications include unauthorized data disclosure of sensitive internal comments and metadata, as well as unauthorized data injection into arbitrary entities across the platform.\nThe attacker capabilities require valid user authentication within the CloudStack environment, but no elevated administrative privileges are necessary.\nSuccessful exploitation relies solely on the ability of an authenticated user to interact with the API endpoints and supply target entity UUIDs while exploiting the flawed ownership validation logic.\nUsers and administrators are strongly advised to apply the official vendor patches to remediate the broken access control flaw.",
  "technicalDetails": "The vulnerability stems from an authorization logic defect in the addAnnotation and listAnnotation APIs within Apache CloudStack.\nThe vulnerable component is responsible for handling entity annotations, where authorization checks are programmatically initiated when an entity's UUID is provided in the API request.\nThe root cause of the vulnerability is that while the APIs execute an ownership check, the codebase fails to properly validate, honor, or enforce the resulting boolean outcome of that security check before proceeding with the transaction.\nConsequently, if the ownership validation fails, the control flow does not reject the operation as expected; instead, it improperly permits execution.\nThe attack flow begins with an authenticated low-privileged user targeting an arbitrary entity within the infrastructure.\nThe attacker obtains or guesses the target entity's UUID, which can often be retrieved through enumeration or shared operational contexts.\nThe attacker then crafts a malicious API request to the listAnnotation endpoint using the target UUID to bypass confidentiality boundaries and disclose existing annotations and comments belonging to other users or tenants.\nSimilarly, the attacker sends a crafted request to the addAnnotation API endpoint, allowing them to inject unauthorized comments or metadata into resources they do not own or administer.\nAuthentication is required to interact with the API, but the privilege requirement is limited to any standard authenticated user role.\nNetwork exposure is defined by the accessibility of the CloudStack management API endpoints.\nPost-exploitation impact includes unauthorized information disclosure of potentially sensitive operational notes, unauthorized tampering with entity annotation records, and potential data integrity degradation within the affected CloudStack environment."
}