The CloudStack Backup plugin fails to enforce authorization when restoring volume backups, allowing any authenticated user who has permission to the restore API to recover volumes that belong to other users. This flaw permits a user to attach an arbitrary‑owned backup to their own VM, exposing the original user's data and potentially disrupting their resources. The weakness is a missing authorization check, classified as CWE‑359.

Apache CloudStack 4.21.0.0 and 4.22.0.0 with the Backup plugin enabled are affected. The vulnerability can be exploited in any environment where the plugin is on and the restore API is accessible. The issue is resolved by upgrading to CloudStack 4.22.0.1 or a later release that includes the fix.

The CVSS score of 8.1 indicates a high severity. The EPSS score of 0.00011, which is less than 1%, indicates a very low but nonzero exploitation probability; the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits are active. The attack requires only normal authenticated access, suggesting a likely intra‑tenant degree of access. The risk lies primarily in the confidentiality and integrity of other tenants’ data and could be high if the attacker can perform large‑scale data retrievals. In the absence of active exploitation, continuous monitoring of restore API activity is advised.