CVE-2025-66172 Lists CVE debrief

Who should care

CloudStack operators running the Backup plugin on 4.21.0.0 or 4.22.0.0, especially environments that expose the affected backup/restore APIs to authenticated users. Backup administrators, platform security teams, and anyone managing tenant isolation should treat this as a priority review item.

Technical summary

The issue is an improper access logic problem in the CloudStack Backup plugin rather than a code-execution bug. According to the advisory text, the vulnerable condition exists when the plugin is enabled in CloudStack 4.21.0.0+ and an authenticated user has access to specific APIs. NVD lists the issue as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N and associates it with CWE-359. The practical impact is unauthorized restore and reassignment of backup-derived storage across users/tenants.

Defensive priority

High. This is remotely reachable, requires only low-privilege authenticated access, and can expose or repurpose another user's backup data and volumes. The impact is concentrated on confidentiality and integrity, with no availability impact listed, but the cross-tenant nature makes it especially important for multi-user CloudStack deployments.

Recommended defensive actions

• Upgrade CloudStack to 4.22.0.1 as recommended in the advisory.
• Verify whether the Backup plugin is enabled in any CloudStack 4.21.0.0+ environment.
• Review API access controls and tenant isolation settings for backup and volume-restore workflows.
• Audit recent backup restore and volume attachment activity for unexpected cross-account actions.
• If immediate upgrade is not possible, restrict access to the affected APIs to the smallest possible authenticated admin/user set until remediation is complete.
• Confirm that monitoring and alerting cover backup restore events and volume attachments across tenant boundaries.

Evidence notes

Source corpus indicates: (1) the CVE description states an improper access logic issue in the CloudStack Backup plugin for versions 4.21.0.0 and 4.22.0.0; (2) authenticated users with access to specific APIs can restore volumes from another user's backups and attach them to their own VMs; (3) the recommended fix is CloudStack 4.22.0.1. NVD metadata provides CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N and CWE-359. References supplied in the corpus are the Apache security mailing list advisory and an oss-security mirror.

Official resources