{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/webvirtcloud--bb920b0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:webvirtcloud:webvirtcloud:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-122224"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WebVirtCloud (\u003c= bb920b0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WebVirtCloud"],"content_html":"\u003cp\u003eWebVirtCloud versions up to commit bb920b0 fail to define \u003ccode\u003epermission_classes\u003c/code\u003e for the \u003ccode\u003eMigrateViewSet\u003c/code\u003e and \u003ccode\u003eCreateInstanceViewSet\u003c/code\u003e Django REST Framework endpoints. This results in the API defaulting to \u003ccode\u003eAllowAny\u003c/code\u003e, permitting authenticated users to access administrative functions. An attacker can exploit this to migrate virtual machines, undefine existing virtual machines, and create new volumes or domains on any compute host managed by the application.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eImpact includes unauthorized control over virtualized compute resources. Attackers can migrate or delete virtual machines and provision unauthorized infrastructure on compute hosts, potentially leading to service disruption or unauthorized resource consumption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit WebVirtCloud installations to identify instances using affected versions up to commit bb920b0.\u003c/li\u003e\n\u003cli\u003eImplement access control list (ACL) restrictions at the web application firewall or reverse proxy level for the \u003ccode\u003e/api/v1/migrate/\u003c/code\u003e and compute instance creation endpoints until a patch is applied.\u003c/li\u003e\n\u003cli\u003eRestrict access to the API to trusted management subnets.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T22:10:00Z","date_published":"2026-11-04T22:10:00Z","id":"https://feed.craftedsignal.io/briefs/2026-11-webvirtcloud-auth-bypass/","summary":"WebVirtCloud versions up to commit bb920b0 suffer from missing authorization on Django REST Framework API endpoints, allowing authenticated users to perform unauthorized VM migration and domain manipulation.","title":"WebVirtCloud: Unauthorized API access via missing permissions (CVE-2026-122224)","url":"https://feed.craftedsignal.io/briefs/2026-11-webvirtcloud-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - WebVirtCloud (\u003c= Bb920b0)","version":"https://jsonfeed.org/version/1.1"}