CVE-2025-66467

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-66467

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66467.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-66467

Published

2026-05-08T12:16:04.822Z

Modified

2026-07-08T07:07:13.269715537Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Apache CloudStack: MinIO policy remains intact on bucket deletion

Details

Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners can gain unauthorized read and write access to it by using the previously generated access and secret keys.

Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66467.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-459"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.19.0.0"
                },
                {
                    "last_affected": "4.20.2.0"
                },
                {
                    "introduced": "4.21.0.0"
                },
                {
                    "last_affected": "4.22.0.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/apache/cloudstack

Affected ranges

Type

GIT

Repo

https://github.com/apache/cloudstack

Events

Introduced

2746225b999612f156e421199e34ef8de98a3664

Fixed

c8599040b4756034c7105806a53d2c99eb7ea0fe

Database specific

{
    "cpe": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "4.19.0.0"
        },
        {
            "fixed": "4.20.3.0"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66467.json"