CVE-2026-65613

Apache CloudStack: Webhook Deliveries Incorrect Access

View on CVE.org
Published Aug 21, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.

This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Analysis

AI-generated

Technical impact

Apache CloudStack users can access or delete sensitive webhook delivery information because an access control check is omitted in the API handling of listing and deleting deliveries. This flaw leads to exposure of confidential data and loss of data integrity for the deliveries stored by the platform.

Affected Systems

The vulnerability affects Apache CloudStack provided by the Apache Software Foundation. The affected variants include version series 4.20.x from 4.20.0.0 through 4.20.3.0 and 4.21.x through 4.22.1.0.

Risk and Exploitability

The CVSS score is 4.3 and the EPSS score is < 1%, so the severity assessment relies on the potential confidentiality impact and the widespread presence across several release lines. Based on the description, it is inferred that an attacker can exploit the vulnerability by interacting with the webhook delivery management APIs over the network. The KEV catalog does not list active exploitation, yet the existence of the flaw across multiple releases suggests a non‑negligible risk and warrants immediate attention.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1 or later, which contains the fix for the access control issue.
  • Limit exposure of the webhook delivery API endpoints by restricting network access to trusted hosts or subnets, such as through firewall rules or a reverse proxy.
  • Review the authorization logic for the webhook delivery APIs and enforce role‑based access control so that only authorized users can list or delete deliveries.

Generated by OpenCVE AI on August 24, 2026 at 20:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Apache
Apache cloudstack
Vendors & Products Apache
Apache cloudstack
Type Values Removed Values Added
Description Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Title Apache CloudStack: Webhook Deliveries Incorrect Access
Weaknesses CWE-200
CWE-284
References
Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control

Sources

Status
PUBLISHED
Assigner
apache
Published
Updated
Aug 24, 2026, 5:05 PM
Reserved
Jul 22, 2026, 11:23 AM

View source JSON

Updated
Aug 24, 2026, 5:05 PM

JSON

Status
Analyzed
Published
Aug 21, 2026, 9:16 AM
Modified
Oct 16, 2026, 3:10 PM

View source JSON

No data.

Updated
Aug 24, 2026, 8:45 PM

JSON