CVE-2026-59799

Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow

Published Aug 21, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow.

This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Analysis

Technical impact

Improper privilege management in the Two‑factor authentication plugin allows a user lacking sufficient privileges to disable the two‑factor authentication enforcement. This flaw effectively lets an attacker bypass MFA and gain elevated access to the system, compromising confidentiality and integrity of protected resources. The weakness is identified as CWE‑269.

Affected Systems

Apache CloudStack editions from 4.18.0.0 up to and including 4.20.3.0, and from 4.21.0.0 up to and including 4.22.1.0, are affected.

Risk and Exploitability

The vulnerability can be exploited by an authenticated user who can submit a request to disable two‑factor authentication but is not subject to proper privilege checks, allowing removal of MFA protections. The flaw carries a CVSS score of 8.8. The EPSS score is 0.00182, indicating a very low probability of exploitation but still possible. The issue is not listed in the CISA KEV catalog, so no exploitation reports from that source. Patch releases are available, and there is no official workaround, so upgrading immediately is the advised action.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache CloudStack

unaffected

Version	Status	Constraints
`4.18.0.0`	affected	≤ 4.20.3.0
`4.21.0.0`	affected	≤ 4.22.1.0

Configuration 1 [-]

OR	cpe:2.3:a:apache:cloudstack::::::::
	cpe:2.3:a:apache:cloudstack::::::::

No data.

Vendor Product Versions

Apache

Cloudstack

Version	Status	Scheme	Platform
`[4.18.0.0,4.20.3.0]`	affected	generic	—
`[4.21.0.0,4.22.1.0]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade your Apache CloudStack installation to version 4.20.3.1, 4.22.1.1, or a later release that contains the fix.
Verify that disabling two‑factor authentication now requires administrative privileges by testing with a non‑admin account.
Review audit logs for any unauthorized attempts to disable two‑factor authentication and audit user permissions periodically.

Generated by OpenCVE AI on August 24, 2026 at 19:26 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.604% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc

History

Aug 27, 2026 12:30 AM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:apache:cloudstack::::::::

Aug 24, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 21, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache cloudstack
Vendors & Products		Apache Apache cloudstack

Aug 21, 2026 8:45 AM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Title		Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow
Weaknesses		CWE-269
References		https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc