This vulnerability is a case of improper authorization (CWE‑283) where Barman trusts snapshot identifiers stored in the backup.info file without verifying that the snapshots actually belong to the backup being deleted. If an attacker can write or overwrite the backup catalog, they can replace valid snapshot identifiers with those of unrelated snapshots. When the deletion routine runs, it passes these identifiers to the cloud provider’s delete API using Barman’s own credentials, causing the cloud infrastructure to delete any snapshot that the Barman identity can reach. The effect is irreversible data loss for backups that were not intended to be removed.

EnterpriseDB Barman versions 3.4.0 onward to 3.20.0 are affected This includes 3.4.0 for Google Cloud, 3.6.0 for Microsoft Azure, and 3.7.0 for AWS. All supported cloud platforms that Barman interacts with are susceptible when the attack conditions are met.

The CVSS score of 7.2 indicates a moderate-to-high severity. Exploitation requires the attacker to have write access to the backup catalog that is separate from the identity Barman uses to delete snapshots. If catalog write permissions are loosely controlled, the likelihood of exploitation increases. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a relatively low exploitation probability in the wild. However, once the attacker gains the necessary catalog write capability, the deletion can occur automatically and affect multiple snapshots without further interaction.