Incus contains an authorization flaw that allows a user who knows the name of a project and a custom volume within that project to copy the volume into a new project, even when the user has no access rights to the source project. This bypass can expose secrets stored in the volume and compromise data confidentiality. The weakness is a classic denial of authorization condition, reflected by CWE-284.

All Incus installations running a version prior to 7.2.0 are vulnerable. The issue was fixed in Incus 7.2.0, which restores proper project access controls for custom volume copy operations.

The CVSS score of 7.7 indicates high severity. The exploitability requires the attacker to know the exact project and volume names and to have the ability to invoke the Incus API or command‑line interface. Because the CI or API must be reachable, the attack vector is likely local or over an untrusted network connection to the Incus daemon, which limits exposure to environments where such access is possible. No known public exploits are listed; the vulnerability is not yet included in CISA’s KEV catalog and EPSS data is unavailable.