https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 00:12:34 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-71195 <p>In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller&#39;s own project context, then load a foreign public share without re-authorizing against the share&#39;s actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant&#39;s share; deny_access: revoke the owner&#39;s existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker&#39;s project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner&#39;s deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.</p> <p>In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller&#39;s own project context, then load a foreign public share without re-authorizing against the share&#39;s actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant&#39;s share; deny_access: revoke the owner&#39;s existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker&#39;s project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner&#39;s deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.</p> https://db.gcve.eu/vuln/fkie_cve-2026-71195 https://db.gcve.eu/vuln/ghsa-xm2x-8fhq-8hpv <p>In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller&#39;s own project context, then load a foreign public share without re-authorizing against the share&#39;s actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant&#39;s share; deny_access: revoke the owner&#39;s existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker&#39;s project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner&#39;s deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.</p> <p>In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller&#39;s own project context, then load a foreign public share without re-authorizing against the share&#39;s actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant&#39;s share; deny_access: revoke the owner&#39;s existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker&#39;s project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner&#39;s deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.</p> https://db.gcve.eu/vuln/ghsa-xm2x-8fhq-8hpv