Auth bypass in Retspen Webvirtcloud
CVE-2026-122224
WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Retspen Webvirtcloud — versions bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3
Weakness classification (CWE)
References
- github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c7… (patch)
- github.com/retspen/webvirtcloud (product)
- github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/i… (technical-description)
- github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/i… (technical-description)
- github.com/retspen/webvirtcloud/issues/689 (issue-tracking)
- hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create (technical-description)
- VulnCheck Advisory: WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints (third-party-advisory)
Frequently asked questions
- What is CVE-2026-122224?
- CVE-2026-122224 is a high-severity vulnerability in Retspen Webvirtcloud, classified under Missing Authorization. CVSS score: 8.1/10. Published 2026-11-04.
- How severe is CVE-2026-122224?
- High severity. CVSS v3 base score is 8.1 out of 10.