Missing authorization in WebVirtCloud migrate and create API endpoints
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
WebVirtCloud through commit bb920b0 has a missing authorization flaw (CWE-862) in its REST API. The migrate and compute instance create endpoints declare no permission classes, so Django REST Framework allows all requests by default. A low-privileged authenticated user can migrate or undefine other users' virtual machines and create volumes and domains on any compute host.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for WebVirtCloud.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Timeline
- 2026-11-04 Threatist record created from CVE-2026-122224
- 2026-11-04 Alias added: GHSA-3cpq-r4vf-hxwg
- 2026-11-06 Priority changed: MEDIUM → LOW
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 5
- https://github.com/retspen/webvirtcloud/issues/689
- https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L125-L162
- https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L174-L183
- https://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create
- https://github.com/retspen/webvirtcloud
More retspen vulnerabilities
- TI-2026-62506 WebVirtCloud Missing Authorization on Instance Control Actions CVSS 4.0HIGH 8.7
Sources
- CVE-2026-122224 · CVE Program
- CVE-2026-122224 · NVD
- FIRST EPSS
- GHSA-3cpq-r4vf-hxwg · GitHub Advisory Database · CC BY 4.0
- CVE-2026-122224 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences