Medium severity · published May 8, 2026
CVE-2025-66170
Apache CloudStack: Any user can list backups that they should not have access to
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and has access to specific APIs can list backups from any account in the environment. This vulnerability does not allow them to see the contents of the backup.
Users are recommended to upgrade to version 4.22.0.1, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Apache CloudStack · Apache Software Foundation
4.21.0.0 through 4.22.0.0 · source: vendor
CL
Cloudstack · Apache
4.21.0.0 before 4.22.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66170
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66170
Mailing List
https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm
Mailing List
http://www.openwall.com/lists/oss-security/2026/05/09/1
More from Apache CloudStack
9.1
CVE-2026-59085
Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module
9.1
CVE-2026-61398
Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI
9.1
CVE-2026-62440
Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation
9.1
CVE-2026-25199
Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access
8.8
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized mount command