Apache CloudStack: webhook info leak 4.20-4.22 before 4.20.3.1/4.22.1.1
CVE-2026-65613 Published on August 21, 2026
Apache CloudStack: Webhook Deliveries Incorrect Access
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.
This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Vulnerability Analysis
CVE-2026-65613 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Types
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2026-65613 has been classified to as an Information Disclosure vulnerability or weakness.
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-65613 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2026-65613
Want to know whenever a new CVE is published for Apache CloudStack? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache CloudStack:- Version 4.20.0.0, <= 4.20.3.0 is affected.
- Version 4.21.0.0, <= 4.22.1.0 is affected.