Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and has access to specific APIs can list backups from any account in the environment. This vulnerability does not allow them to see the contents of the backup. Users are recommended to upgrade to version 4.22.0.1, which fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-66170 The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0… https://www.cve.org/CVERecord?id=CVE-2025-66170
Post summary
A brief disclosure that CloudStack Backup plugin versions 4.21.0.0 and 4.22.0.0 contain an improper authorization logic vulnerability (CVE-2025-66170).
CVE-2025-66170 Improper Authorization in CloudStack Backup Plugin Versions 4.21.0.0 and 4.22.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-66170
Post summary
The post announces CVE‑2025‑66170 as an improper authorization issue in CloudStack Backup Plugin versions 4.21.0.0–4.22.0.0, without details on PoC, exploitation, or patch availability.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | cloudstack | - | - | - |