Apache CloudStack Access Validation Vulnerability Allowing Unauthorized Annotation Management

An access validation vulnerability has been identified in Apache CloudStack versions 4.16.0 and later. This issue allows users with knowledge of resource UUIDs to list and add comments (annotations) on resources they are authorized to access. While this vulnerability could lead to a loss of confidentiality if annotations contain privileged information, the overall impact is considered very low. CloudStack administrators can temporarily restrict access to the annotation management APIs for non-admin roles.

Impact

Exploitation of this vulnerability could result in unauthorized reading or modification of annotations on CloudStack resources, potentially exposing confidential information if annotations contain sensitive data.

Remediation

CloudStack administrators can disable the 'listAnnotations' and 'addAnnotation' API access for non-admin roles as a temporary measure.