What is GHSA-c5q4-rxv3-w923?

GHSA-c5q4-rxv3-w923 is a security advisory published by GitHub Security Advisories with High severity. Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability...

Which CVE IDs does GHSA-c5q4-rxv3-w923 cover?

GHSA-c5q4-rxv3-w923 covers the following CVE IDs: CVE-2026-115376. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c5q4-rxv3-w923?

GHSA-c5q4-rxv3-w923 has a CVSS v3 base score of 7.7, published by GitHub Security Advisories.

GHSA-c5q4-rxv3-w923HighCVSS 7.7

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability...

Vendor

GitHub Security Advisories

Published

October 22, 2026

Last Modified

October 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-115376 →

📋 Description

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read other projects' volumes, snapshots, and configuration.

🔗 References (4)

https://github.com/lxc/incus/security/advisories/GHSA-jh4v-j34r-2mgh
https://nvd.nist.gov/vuln/detail/CVE-2026-115376
https://www.vulncheck.com/advisories/incus-7.0.1-before-7.0.2-and-7.2.0-before-7.5.0-project-restriction-bypass-via-custom-volume-copy
https://github.com/advisories/GHSA-c5q4-rxv3-w923