retspen webvirtcloud vulnerabilities

Latest retspen webvirtcloud CVEs

Newest publication first

1. CVE-2026-122224 WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints

   Published 2026-11-04

   High·CVSS 7.2

   WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers...

2. CVE-2026-92761 WebVirtCloud Missing Authorization on Instance Control Actions

   Published 2026-09-16

   High·CVSS 8.7

   WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.