DEBIAN-CVE-2026-93852

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-93852

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93852.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-93852

Upstream

CVE-2026-93852

Published

2026-09-18T19:17:25Z

Modified

2026-09-29T10:00:09Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing lease IDs, reservation IDs, resource IDs, and reservation metadata. The exposed lease IDs also enable the object-level authorization bypass tracked in the companion request, allowing an attacker to then modify or delete the enumerated leases.

References

https://security-tracker.debian.org/tracker/CVE-2026-93852

Affected packages

Debian:13 / blazar

Package

Name: blazar
Purl: pkg:deb/debian/blazar?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

15.*

15.0.0-3

16.*

16.0.0~rc1-1

16.0.0~rc1-2

16.0.0~rc1-3

16.0.0-1

17.*

17.0.0~rc1-1

17.0.0~rc1-3

17.0.0-1

17.0.0-2

18.*

18.0.0~rc1-1

18.0.0~rc1-2

18.0.0~rc1-3

18.0.0~rc2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93852.json"

Debian:14 / blazar