The vulnerability is an improper authorization flaw in the CloudStack Backup plugin that allows any authenticated user to enumerate backups belonging to any account. While the attacker cannot read backup contents, the ability to list backup identifiers exposes sensitive operational information and could be used to inform future targeted attacks. Based on the description, it is inferred that the enumeration of backups could assist attackers in refining social engineering or other attack vectors, though this use is not explicitly confirmed.

Apache Software Foundation’s Apache CloudStack is impacted when the Backup plugin is enabled. Versions 4.21.0.0 and 4.22.0.0 contain the flaw and must be considered vulnerable. All environments running these versions should be evaluated for the presence of the plugin.

The vulnerability can be exercised by any authenticated user via normal API calls. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly disclosed exploits to date. The CVSS score is 6.5, and the risk is primarily driven by potential information disclosure that may aid attackers in planning further operations.