An improper access logic in the CloudStack Backup plugin allows any authenticated CloudStack user to create new virtual machines from backups belonging to other users. The flaw enables a non‑admin actor to instantiate a VM with the same resources and data as the original backup, potentially giving them hidden access to sensitive workloads and infrastructure.

Apache CloudStack environments running versions 4.21.0.0 or 4.22.0.0 with the Backup plugin enabled are affected. Users should upgrade to version 4.22.0.1 or later, which includes the necessary access‑control revision.

The vulnerability requires only authenticated access and the availability of the Backup plugin’s APIs. Exploitability is high for legitimate users within the environment; however, no public exploits are currently documented. The CVSS score of 6.5 indicates medium‑high severity, and with no EPSS figure the exact likelihood of exploitation remains unknown. Nonetheless, the ability to create arbitrary virtual machines from any user's backups poses significant risks to confidentiality, integrity, and availability.