WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints

Advisories

WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints

Severity: high
Date: 11/4/2026
Affecting: webvirtcloud bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3
CVE: CVE-2026-122224
CWE: CWE-862 Missing Authorization
CVSS: 7.2
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
References: https://github.com/retspen/webvirtcloud/issues/689
https://github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c717
https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L125-L162
https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L174-L183
https://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create
https://github.com/retspen/webvirtcloud
Credit: hieuPenguinnn
Description: WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo