CVE-2026-92761

HighCVSS 8.8

Published: 16/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

38th percentile - higher than 38% of all known CVEs

Summary

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the get_instance gate that only checks grant existence.

Risk Assessment

A read-only user can take control of virtual machines, including resetting root passwords and installing their own SSH keys, leading to full system takeover.

Recommendation

Upgrade WebVirtCloud to a patched version and verify that the get_instance gate checks specific permission flags rather than just grant existence.

Other vulnerabilities in WebVirtCloud

CVE-2026-122224High
WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS