Incus, a system container and virtual machine manager, had a missing authorization check that allowed an attacker who knows the name of a project and an instance inside that project to copy the instance into a new project. This flaw is a classic permission‑bypass (CWE‑284), enabling the attacker to obtain secrets and configuration data from instances they should not be able to view. The impact is therefore the unauthorized exposure of sensitive data and a pathway to privilege escalation within the Incus environment.

All releases of Incus prior to version 7.2.0 are affected. The product is identified by the vendor product pair lxc:incus. Users running any 7.1.x or earlier release should consider themselves vulnerable.

The CVSS score of 7.7 indicates a high severity vulnerability. No EPSS score is available, but the absence of a KEV listing suggests that known exploits are not publicly documented yet. The likely attack vector is through authenticated API or command usage, where an attacker with at least legitimate user access can supply the target project and instance names to trigger the copy. Because the flaw bypasses authorization on the copy operation, a malicious user could elevate their privileges within the container ecosystem by accessing data in other projects.