Dashboard / CVE-2026-122224

CVE-2026-122224

HIGH
MEDIUM Priority: 0.02 BB Relevance: 64/100
Published: 2026-11-04 Modified: 2026-11-09 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: None
VI: High
VA: High

Description

WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
retspen webvirtcloud bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3
retspen webvirtcloud bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3

References & Advisories (7)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.2 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.33%
Raw Score 0.003340
Percentile 27.2%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00334
2026-11-12
0.00334
2026-11-10
0.00334
2026-11-09
0.00334
2026-11-08
0.00334
2026-11-07
0.00334
2026-11-06
0.00334
2026-11-05
0.00334

Intelligence Sources

mitre ref →
nvd ref →

External Links