CVE-2025-59454

published 2025-11-27

CVE-2025-59454: In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails -…

Priority P4 25 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL
- listNetworkACLs
- listResourceDetails
- listVirtualMachinesUsageHistory
- listVolumesUsageHistory

While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope.

Users are recommended to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, which fixes the issue.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
apache	cloudstack	—	—
apache	cloudstack	>= 4.0.0 < 4.20.2.0	4.20.2.0
apache_software_foundation	apache_cloudstack	>= 4.0.0 < 4.20.2	4.20.2
apache_software_foundation	apache_cloudstack	>= 4.21.0 < 4.22.0	4.22.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200