The vulnerability is an authorization bypass that allows an authenticated LXD user to move or restore volumes across projects without the normal quota checks. This omission is present in the storagePoolVolumeTypePostMove function when a volume is transferred and in the snapshot restore path when the configuration is nil. The result is that an attacker can create or restore volumes that exceed the administrative quota set for a project, potentially exhausting host storage resources or violating compliance policies.

The flaw affects Canonical LXD installations running versions prior to LXD 5.0.8, LXD 5.21.6, or LXD 6.10. Users on earlier releases of these series are vulnerable and must apply the update to reach the patched versions.

With a CVSS score of 8.5 the vulnerability is classified as high severity. Although the EPSS score is not available, the lack of a KEV listing does not diminish the risk because the flaw is limited to authenticated users and allows repeated abuse of storage quotas. An attacker can perform multiple volume moves or snapshot restores to inflate project usage beyond the set limits, which can lead to denial‑of‑service or resource exhaustion on the host. The attack vector requires only valid project credentials, making it broadly actionable for any legitimate user within the project.