CVE-2026-65613: Apache CloudStack: Webhook Deliveries Incorrect Access
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.
This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CloudStack (Webhook module)to a version that resolves this vulnerability.Fixed in 4.20.3.1 - Upgrade
Upgrade
Apache CloudStack (Webhook module)to a version that resolves this vulnerability.Fixed in 4.22.1.1
Event History
Frequently Asked Questions
Which CloudStack deployments are affected?
Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected. The issue is in the Webhook module's delivery listing and deletion operations.
What information or operations are exposed?
The vulnerability can expose sensitive information to an unauthorized actor when webhook deliveries are listed or deleted. The provided information does not identify the specific data exposed or the authorization conditions required for exploitation.
What versions remediate the issue?
Upgrade to Apache CloudStack 4.20.3.1, 4.22.1.1, or a later version. These releases fix the issue.