n Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHistory - listVolumesUsageHistory While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope. Users are recommended to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, which fixes the issue.
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6svjbs9xbc | Vendor Advisory Mailing List |
| http://www.openwall.com/lists/oss-security/2025/11/27/3 | Mailing List Third Party Advisory |
Configuration 1 (hide)
|
02 Dec 2025, 14:38
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache cloudstack
Apache |
|
| References | () https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6svjbs9xbc - Vendor Advisory, Mailing List | |
| References | () http://www.openwall.com/lists/oss-security/2025/11/27/3 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:apache:cloudstack:4.21.0.0:*:*:*:*:*:*:* cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:* |
28 Nov 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
27 Nov 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Nov 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Published : 2025-11-27 12:15
Updated : 2025-12-02 14:38
NVD link : CVE-2025-59454
Mitre link : CVE-2025-59454
CVE.ORG link : CVE-2025-59454
JSON object : View
Exposure of Sensitive Information to an Unauthorized Actor