CVE-2025-30675

In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attacker to gain unauthorized visibility into templates and ISOs under the ROOT domain. A malicious admin can enumerate and extract metadata of templates and ISOs that belong to unrelated domains, violating isolation boundaries and potentially exposing sensitive or internal configuration details.  This vulnerability has been fixed by ensuring the domain resolution strictly adheres to the caller's scope rather than defaulting to the ROOT domain. Affected users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0.

• CWE-200

• https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/Vendor Advisory
• https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60Mailing List, Vendor Advisory
• https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/Broken Link

Published

Jun 11, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30669Improper certificate validation in certain Zoom Clients may …6.5
• CVE-2025-3067Inappropriate implementation in Custom Tabs in Google Chrome…8.6
• CVE-2025-30670Null pointer dereference in some Zoom Workplace Apps for Win…6.5
• CVE-2025-30671Null pointer dereference in some Zoom Workplace Apps for Win…6.5
• CVE-2025-30672Mite for Perl before 0.013000 generates code with the curren…6.5
• CVE-2025-30673Sub::HandlesVia for Perl before 0.050002 allows untrusted co…6.5
• CVE-2025-30676Improper Neutralization of Script-Related HTML Tags in a Web…6.1
• CVE-2025-30677Apache Pulsar contains multiple connectors for integrating w…6.5
• CVE-2025-30678A Server-side Request Forgery (SSRF) vulnerability in Trend …7.5
• CVE-2025-30679A Server-side Request Forgery (SSRF) vulnerability in Trend …7.5
• CVE-2025-3068Inappropriate implementation in Intents in Google Chrome on …8.8
• CVE-2025-30680A Server-side Request Forgery (SSRF) vulnerability in Trend …7.1