CVE-2025-22829

Medium

Description

The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations. Quota plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this issue.

SeverityMedium

CVSS4.3

Exploit probability—

Product

Apache Cloudstack

PublishedJun 10, 2025

First seenJun 10, 2025

Weakness typeCWE-269Improper privilege management

How to fix

Vendor advisories

cloudstack.staged.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0

Affected products

Product	Affected versions	Fixed in
apache cloudstack	4.20.0.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.