Incus versions 7.0.1 through before 7.0.2 and 7.2.0 through before 7.5.0 contain an improper authorization flaw that lets a user with project‑level permissions omit the optional source.type field in a POST request to the custom volumes API and copy and read volumes, snapshots, and configuration from projects where they normally have no access. A successful exploitation would grant the attacker confidentiality and integrity access to data belonging to other projects, effectively bypassing project isolation.

The vulnerability affects deployments running Incus 7.0.1 prior to the 7.0.2 update and Incus 7.2.0 prior to the 7.5.0 update. All users who can issue volume‑copy requests through the Incus API, even when lacking broader project permissions, are impacted.

The flaw has a CVSS score of 8.3, indicating severe risk. An attacker can trigger the vulnerability over the network by crafting a POST request to the API endpoint; no local privilege or additional context is required beyond standard project membership. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog, so the current likelihood of exploitation is unknown, but the high severity and remote attack vector suggest that active scanning for this behavior could be fruitful.