CVE-2025-22829

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-22829
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22829.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-22829
Published
2025-06-10T23:11:24Z
Modified
2026-10-28T02:31:04Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber CVSS Calculator
Summary
Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin
Details

The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations.

Quota plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-269"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22829.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "4.20.0.0"
                        },
                        {
                            "fixed": "4.20.1.0"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/cloudstack

Affected ranges

Type
GIT
Repo
https://github.com/apache/cloudstack
Events
Introduced
2fe3fcef7c77cf9a1b629c9df3afc0cdb88ad4f6
Last Affected
2fe3fcef7c77cf9a1b629c9df3afc0cdb88ad4f6
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:apache:cloudstack:4.20.0.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.20.0.0"
                },
                {
                    "last_affected": "4.20.0.0"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

4.*
4.20.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22829.json"