CVE-2025-66170: Apache CloudStack: Any user can list backups that they should not have access to
The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and has access to specific APIs can list backups from any account in the environment. This vulnerability does not allow them to see the contents of the backup.
Users are recommended to upgrade to version 4.22.0.1, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66170?
CVE-2025-66170 is classified as a high severity vulnerability due to improper authorization in the Apache CloudStack Backup plugin.
How do I fix CVE-2025-66170?
To fix CVE-2025-66170, upgrade the Apache CloudStack Backup plugin to a version beyond 4.22.0.0 or implement access controls to restrict user permissions.
Who is affected by CVE-2025-66170?
CVE-2025-66170 affects any user with authenticated access in Apache CloudStack environments running versions 4.21.0.0 or 4.22.0.0 with the Backup plugin enabled.
What is the impact of CVE-2025-66170?
The impact of CVE-2025-66170 is that unauthorized users can access and list backups they should not have permissions to access.
Is there a workaround for CVE-2025-66170?
While upgrading is the recommended approach, a temporary workaround for CVE-2025-66170 includes manually adjusting user permissions to limit access to the Backup plugin.