Apache CloudStack fails to delete the MinIO policy that is tied to a bucket when that bucket is removed. The residual policy continues to allow the original owner’s access keys to work against any bucket that later inherits the same name, granting read and write privileges to a new owner. This is a "Removal at deletion" flaw (CWE‑459) that can compromise confidentiality and integrity of data stored in MinIO. The impact is a persistent, unauthorized access to the object storage that can be used to exfiltrate or modify data.

The vulnerability affects Apache CloudStack versions prior to 4.20.3.0 and 4.22.0.1, as distributed by the Apache Software Foundation. All deployments integrating MinIO as the object store are impacted until the patch is applied.

The CVSS score of 8.0 indicates high severity. The EPSS score is not available, so current exploitation likelihood is unknown, but the vulnerability is not listed in CISA KEV. Attackers likely need internal access to the CloudStack management interface to delete a bucket and then create a new one with the same name, implying an internal or privileged compromise vector. Once the scenario is set up, the residual keys provide continuous unauthorized access without further action from the attacker.