WebVirtCloud: Unauthorized API access via missing permissions (CVE-2026-122224)
WebVirtCloud versions up to commit bb920b0 suffer from missing authorization on Django REST Framework API endpoints, allowing authenticated users to perform unauthorized VM migration and domain manipulation.
CVE search metadata
CVE search record: CVE-2026-122224. Severity: high. CVSS: 8.1. KEV: no. Product: WebVirtCloud (<= bb920b0). Brief: WebVirtCloud: Unauthorized API access via missing permissions (CVE-2026-122224). Brief link: https://feed.craftedsignal.io/briefs/2026-11-webvirtcloud-auth-bypass/
Triage facts
Revision 1- Applicability
- WebVirtCloud (<= bb920b0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 22:10 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
WebVirtCloud versions up to commit bb920b0 fail to define permission_classes for the MigrateViewSet and CreateInstanceViewSet Django REST Framework endpoints. This results in the API defaulting to AllowAny, permitting authenticated users to access administrative functions. An attacker can exploit this to migrate virtual machines, undefine existing virtual machines, and create new volumes or domains on any compute host managed by the application.
Impact
Impact includes unauthorized control over virtualized compute resources. Attackers can migrate or delete virtual machines and provision unauthorized infrastructure on compute hosts, potentially leading to service disruption or unauthorized resource consumption.
Recommendation
- Audit WebVirtCloud installations to identify instances using affected versions up to commit bb920b0.
- Implement access control list (ACL) restrictions at the web application firewall or reverse proxy level for the
/api/v1/migrate/and compute instance creation endpoints until a patch is applied. - Restrict access to the API to trusted management subnets.
Threat Hunt
Identify authenticated requests to /api/v1/migrate/ or instance creation endpoints originating from low-privileged user sessions
Data: Web server access logs
Mitigations
Apply security patch or restrict API access to the affected endpoints
CVE-2026-122224