WebVirtCloud (<= Bb920b0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/webvirtcloud--bb920b0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 22:10:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWebVirtCloud: Unauthorized API access via missing permissions (CVE-2026-122224)https://feed.craftedsignal.io/briefs/2026-11-webvirtcloud-auth-bypass/Wed, 04 Nov 2026 22:10:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-webvirtcloud-auth-bypass/WebVirtCloud versions up to commit bb920b0 suffer from missing authorization on Django REST Framework API endpoints, allowing authenticated users to perform unauthorized VM migration and domain manipulation.WebVirtCloud versions up to commit bb920b0 fail to define permission_classes for the MigrateViewSet and CreateInstanceViewSet Django REST Framework endpoints. This results in the API defaulting to AllowAny, permitting authenticated users to access administrative functions. An attacker can exploit this to migrate virtual machines, undefine existing virtual machines, and create new volumes or domains on any compute host managed by the application.

Impact

Impact includes unauthorized control over virtualized compute resources. Attackers can migrate or delete virtual machines and provision unauthorized infrastructure on compute hosts, potentially leading to service disruption or unauthorized resource consumption.

Recommendation

  • Audit WebVirtCloud installations to identify instances using affected versions up to commit bb920b0.
  • Implement access control list (ACL) restrictions at the web application firewall or reverse proxy level for the /api/v1/migrate/ and compute instance creation endpoints until a patch is applied.
  • Restrict access to the API to trusted management subnets.
]]>highadvisory