CVE ID :CVE-2026-122224
Published : Nov. 4, 2026, 8:36 p.m. | 45 minutes ago
Description :WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users’ virtual machines and create volumes and domains on any compute host.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more… To Read More Visit Read More