Incus versions 7.0.1 through before 7.0.2 and 7.2.0 through before 7.5.0 contain an improper authorization flaw that lets a user with project‑level permissions omit the optional source.type field in a POST request to the custom volumes API and copy and read volumes, snapshots, and configuration from projects where they normally have no access. A successful exploitation would grant the attacker confidentiality and integrity access to data belonging to other projects, effectively bypassing project isolation. This flaw corresponds to the vulnerabilities categorized as CWE‑284 (Improper Access Control) and CWE‑639 (Privilege/Permission Missing in Credential).

The vulnerability affects deployments running Incus 7.0.1 prior to the 7.0.2 update and Incus 7.2.0 prior to the 7.5.0 update. All users who can issue volume‑copy requests through the Incus API, even when lacking broader project permissions, are impacted.

The flaw has a CVSS score of 8.3, indicating severe risk. An attacker can trigger the vulnerability over the network by crafting a POST request to the API endpoint; no local privilege or additional context is required beyond standard project membership. The EPSS score is 0.00273 (0.27%), and the vulnerability is not listed in the CISA KEV catalog, so the current likelihood of exploitation is very low, but the high severity and remote attack vector suggest that active scanning for this behavior could be fruitful.