CVE-2025-59454: cloudstack 4.21.0.0; +1 more affected products

Affected technology

cloudstack · from 4.0.0 (inclusive), before 4.20.2.0 (exclusive)
apache

cloudstack · 4.21.0.0
apache

Apache CloudStack · 4.0.0 to before 4.20.2, 4.21.0 to before 4.22.0
Apache Software Foundation

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says in Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHistory - listVolumesUsageHistory While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope. Source advisory’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality impact as low; integrity and availability impact as none.