Access Control Vulnerability in Apache CloudStack APIs
CVE-2025-59454

4.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Cloudstack
Vendor
CVE Published:
27 November 2025

What is CVE-2025-59454?

A security issue in Apache CloudStack was identified that affects certain APIs related to network ACLs and resource usage. Although these APIs are meant to be restricted to authorized users, inadequate permission validation allowed for potential information exposure, enabling users to access data outside their intended boundaries. This vulnerability underscores the importance of thorough access control measures in API implementations. Users are advised to upgrade to Apache CloudStack versions 4.20.2.0 or 4.22.0.0 to mitigate this risk.

Affected Version(s)

Apache CloudStack 4.0.0 < 4.20.2

Apache CloudStack 4.21.0 < 4.22.0

References

https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6sv...
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

[email protected] <https://github.com/ai-bugreporter/Credits>
JSON
.
CVE-2025-59454 : Access Control Vulnerability in Apache CloudStack APIs