WebVirtCloud REST API missing authorization lets users tamper with others' VMs

A web tool for virtual servers lets ordinary accounts move or delete others' servers.

Summary

WebVirtCloud's REST API migrate and instance create endpoints have no authorization checks. Logged-in low-privileged users can migrate or undefine other users' virtual machines and create volumes and domains on any compute host.

Affected when

A logged-in account with low privileges

What to do

Check that you run a version newer than commit bb920b0 and read the vendor's advisory. The sources name no fixed version.

Products and platforms

webvirtcloud

CVE IDs

CVE-2026-122224 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · hackmd.io (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 20:36 UTC

First seen 2026-11-09 16:00 UTC