Multiple API operations in OpenStack Manila do not verify that an authenticated caller owns a public share before performing actions. This omission allows an authenticated project member to grant or revoke access, change access levels, create backups under their own project to exfiltrate data, delete or restore foreign shares, modify export location metadata, and read detailed metadata such as IPs, usernames, and CephFS keys. The weakness follows CWE‑639 and CWE‑863 and can compromise confidentiality, integrity, and availability of shared resources.

OpenStack Manila before version 23.0.1. All installations that enable public shares are affected, regardless of user role within the project. The vulnerability applies to operations such as allow_access, deny_access, update_access, create_share_backup, soft_delete, restore, export location metadata modifications, and access rule listing.

The CVSS base score of 9.9 indicates a critical security risk, while a very low EPSS score (<1%) suggests that exploitation is not widespread yet. The vulnerability is not yet listed in CISA's KEV catalog. Attackers need only authenticated API access within a project, making the attack vector internal. Consequently, any internal user or compromised credentials could potentially abuse public shares for data exfiltration or denial of service.