What is GHSA-454g-wxrr-37fg?

GHSA-454g-wxrr-37fg is a security advisory published by GitHub Security Advisories with unknown severity. Missing authorization issue for domain admins in CloudStack's host tags listing functionality. ...

Which CVE IDs does GHSA-454g-wxrr-37fg cover?

GHSA-454g-wxrr-37fg covers the following CVE IDs: CVE-2026-66721. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-454g-wxrr-37fgunknown

Missing authorization issue for domain admins in CloudStack's host tags listing functionality. ...

Vendor

GitHub Security Advisories

Published

August 21, 2026

Last Modified

August 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-66721 →

📋 Description

Missing authorization issue for domain admins in CloudStack's host tags listing functionality.

Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.

This issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-66721
https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
https://github.com/advisories/GHSA-454g-wxrr-37fg