CVE-2026-122224
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.
Risk Assessment
Low privileges are sufficient to manipulate other users' virtual machines and create resources on any host, potentially breaking isolation and compromising the infrastructure.
Recommendation
Update WebVirtCloud to a patched version or manually declare appropriate permission_classes in MigrateViewSet and CreateInstanceViewSet.
Other vulnerabilities in WebVirtCloud
Original NVD description (English source)
WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS