CVE-2026-122224 Details

A missing authorization vulnerability has been identified in WebVirtCloud, specifically in the REST API migration and instance creation endpoints. This issue allows low-privileged authenticated users to access the MigrateViewSet and CreateInstanceViewSet, as these viewsets do not declare any permission classes. Consequently, Django REST Framework defaults to AllowAny, leaving these endpoints open to all authenticated users. Attackers can exploit this vulnerability to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.

The vulnerability can be addressed by adding the missing permission classes to the affected viewsets and implementing proper authorization checks. This can be done by routing instance-related API actions through a helper function that enforces ownership grants, similar to the existing checks in the WebVirtCloud HTML interface.