Medium severity · published Aug 21, 2026
CVE-2026-66797
Apache CloudStack: Unauthorised comment creation and disclosure
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.
The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID.
This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Apache CloudStack · Apache Software Foundation
4.16.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 · source: vendor
CL
Cloudstack · Apache
4.15.0.0 before 4.20.3.1; 4.21.0.0 before 4.22.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66797
Mailing List
https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
More from Apache CloudStack
9.1
CVE-2026-59085
Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module
9.1
CVE-2026-61398
Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI
9.1
CVE-2026-62440
Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation
9.1
CVE-2026-25199
Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access
8.8
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized mount command