{"id":"CVE-2026-122224","kind":"vulnerability","aliases":["CVE-2026-122224"],"related":[],"title":"WebVirtCloud: missing authorization lets low-privileged users migrate others' virtual machines","description":"WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.","summary":"WebVirtCloud, a web panel for managing KVM virtual machines, does not declare permission checks on its migrate and instance-create API endpoints, so Django REST Framework allows any logged-in user through. An authenticated low-privileged user can migrate or undefine other users' virtual machines and create volumes and domains on any compute host.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"webvirtcloud","fixed":[],"affected":"<= commit bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3","ecosystem":"github"}],"ecosystems":[],"tags":["kvm","other","self-hosted","virtualization","webvirtcloud"],"not_affected_if":["admin-only-users","no-network-access","no-untrusted-accounts","single-user-install"],"how_to_check":"Check whether your WebVirtCloud code is at or before commit bb920b0 (retspen/webvirtcloud). In instances/api/viewsets.py, look at MigrateViewSet and CreateInstanceViewSet: if neither declares permission_classes, any logged-in user can call /api/v1/migrate/ and the instance-create endpoint. Also check whether non-admin accounts exist on the panel.","fix":"No release yet. Commit 1227674 in the catborise/webvirtcloud fork sets permission_classes = [IsAdminUser] on MigrateViewSet and CreateInstanceViewSet (and other API viewsets); per the maintainer comment on upstream issue #689 it is not merged into retspen/webvirtcloud yet. Until then, apply that commit or add IsAdminUser to those viewsets.","status":"open","published_at":"2026-11-04T21:18:10+00:00","first_seen_at":"2026-11-04T21:49:21+00:00","triaged_at":"2026-11-04T21:50:49+00:00","updated_at":"2026-11-04T21:53:22+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-04T21:50:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WebVirtCloud: missing authorization lets low-privileged users migrate others' virtual machines","impact":"high","summary":"WebVirtCloud, a web panel for managing KVM virtual machines, does not declare permission checks on its migrate and instance-create API endpoints, so Django REST Framework allows any logged-in user through. An authenticated low-privileged user can migrate or undefine other users' virtual machines and create volumes and domains on any compute host.","audience":"businesses","category":"other","nicknames":[],"who_cares":["webvirtcloud","kvm","self-hosted","virtualization"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker migrates or undefines other users' virtual machines and creates volumes","analyst_note":"Find the fixed version or patch commit from the GitHub patch link and confirm the endpoint permission fix.","how_to_check":"- Check the WebVirtCloud version or commit in the deployed code; the sources say the flaw is present through commit `bb920b0`.\n- Look for `permission_classes` on `MigrateViewSet` and `CreateInstanceViewSet` in the WebVirtCloud API code; if none are declared, the endpoints default to AllowAny.\n- Confirm whether non-admin accounts can log in to the panel at all.","plain_action":"","needs_analyst":true,"not_affected_if":["single-user-install","no-untrusted-accounts"],"who_is_affected":"Teams that run a self-hosted WebVirtCloud panel with more than one user account are exposed, because any logged-in account can reach the affected API endpoints. A single-user installation where every account is trusted is much less exposed. The sources point to a patch on GitHub but do not state the fixed version, so the exact upgrade target is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000757,"input_tokens":4216,"output_tokens":670,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version or patch commit from the GitHub patch link and confirm the endpoint permission fix.","search":"'-122224':15A,18A '-2026':14A,17A '/api/v1/migrate':123C 'allow':54B,94C 'allowani':117C 'api':48B 'attack':118C 'authent':62B,98C 'author':3A,91C 'bb920b0':87C 'check':40B 'class':108C 'commit':86C 'comput':82B,126C,145C 'contain':88C 'creat':47B,76B,128C,139C 'createinstanceviewset':104C 'cve':13A,16A 'declar':38B,110C 'default':115C 'django':51B,112C 'domain':79B,142C 'endpoint':49B,129C 'framework':53B,114C 'host':24B,83B,146C 'instanc':46B,127C 'instance-cr':45B 'kvm':20B,33B 'let':4A 'log':57B 'logged-in':56B 'low':6A,64B,96C 'low-privileg':5A,63B,95C 'machin':12A,35B,74B,137C 'manag':32B 'migrat':9A,43B,68B,131C 'migrateviewset':102C 'miss':2A,90C 'other':10A 'panel':30B 'permiss':39B,107C 'privileg':7A,65B,97C 'reach':101C 'request':121C 'rest':52B,113C 'self':23B 'self-host':22B 'send':120C 'undefin':70B,133C 'user':8A,59B,66B,72B,99C,135C 'virtual':11A,25B,34B,73B,136C 'volum':77B,140C 'vulner':92C 'web':29B 'webvirtcloud':1A,19A,26B,27B,84C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted WebVirtCloud panels at or before commit bb920b0 that have non-admin accounts. Any logged-in user can migrate or undefine other users' VMs and create volumes and domains on any compute host. Panels with only trusted admin accounts, or not reachable by untrusted users, are at much lower risk.","tier":"B","verified":{"fix":{"at":"2026-11-04T21:53:22Z","by":"analyst","doc":"https://github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c717","run_id":1717},"how_to_check":{"at":"2026-11-04T21:53:22Z","by":"analyst","doc":"https://github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c717","run_id":1717}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["webvirtcloud"],"ptokens":["webvirtcloud"],"labels":["high","kvm","other","selfhosted","virtualization","webvirtcloud"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122224","severity":null,"published_at":"2026-11-04T21:18:10+00:00","modified_at":"2026-11-04T21:18:10+00:00","first_seen_at":"2026-11-04T21:49:21+00:00","fetched_at":"2026-11-04T21:49:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122224:1717","url":null,"severity":null,"published_at":"2026-11-04T21:53:22+00:00","modified_at":"2026-11-04T21:53:22+00:00","first_seen_at":"2026-11-04T21:53:22+00:00","fetched_at":"2026-11-04T21:53:22+00:00","note":"Read VulnCheck advisory, fix commit 1227674 (catborise fork) and upstream issue 689. Fix is a commit on a fork, not merged upstream per maintainer comment 2026-11-04; no release version."}],"documents":[{"id":70690,"url":"https://github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c717","title":"catborise/webvirtcloud commit 1227674: restrict API to IsAdminUser","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":70692,"url":"https://www.vulncheck.com/advisories/webvirtcloud-through-commit-bb920b0-missing-authorization-in-rest-api-migrate-and-create-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":70881,"url":"https://github.com/retspen/webvirtcloud/issues/689","title":"retspen/webvirtcloud issue 689","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}