CVE-2026-122224: WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints
Published Nov 4, 2026
·Updated
WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permissionclasses are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.
Event History
Nov 4, 2026
CVE Published
via MITRE·08:36 PM
Data Sourced
via MITRE·08:36 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require administrator access or user interaction?
No administrator access or user interaction is required. A low-privileged authenticated user can send requests to the affected API endpoints.
2
What can an attacker affect through the exposed endpoints?
An attacker can migrate or undefine other users' virtual machines. They can also create volumes and domains on any compute host.