The flaw is a missing or insufficient authorization check in several userdata reference APIs of Apache CloudStack. An attacker with access to these endpoints could read or delete userdata belonging to other tenants, thereby compromising privacy and possibly impacting system integrity. The issue is exemplified by weaknesses such as cross‑tenant data access and lack of access validation, as indicated by CWE‑200 and CWE‑862.

Apache Software Foundation: Apache CloudStack versions from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0 are affected. The deleteCniConfiguration API introduced in 4.21.0.0 also suffers from the same lack of access validation.

The vulnerability has a CVSS score of 7.5, indicating high severity, while the EPSS score is reported as less than 1%. It is not listed in the CISA KEV catalog. The APIs are exposed over the CloudStack management interface and can be called with an existing authentication token. The missing authorization check permits cross‑tenant access, allowing an attacker to read or delete userdata belonging to other tenants, which poses confidentiality, integrity, and potential availability risks in multi‑tenant environments.