PT-2026-38913 · Cloudstack · Cloudstack Backup

CVE-2025-66170 · Published 2026-05-08 · Updated 2026-05-09

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CloudStack Backup plugin versions 4.21.0.0 through 4.22.0.0

Description The CloudStack Backup plugin contains improper authorization logic. Authenticated users in environments where this plugin is enabled can list backups from any account in the environment by accessing specific APIs. This issue does not permit the viewing of backup contents.

Recommendations Upgrade to version 4.22.0.1.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-66170

Affected Products

Cloudstack Backup

References · 6

• https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66170 · Security Note
• https://twitter.com/VulmonFeeds/status/2052773424456433841 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/09/1 · Note
• https://twitter.com/CVEnew/status/2053174679150399847 · Twitter Post
• https://t.me/cveNotify/162856 · Telegram Post