Vulnerability Description
Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners can gain unauthorized read and write access to it by using the previously generated access and secret keys. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Cloudstack | >= 4.19.0.0, < 4.20.3.0 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xmMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/05/09/4Mailing ListThird Party Advisory
FAQ
What is CVE-2025-66467?
CVE-2025-66467 is a vulnerability with a CVSS score of 8.0 (HIGH). Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the...
How severe is CVE-2025-66467?
CVE-2025-66467 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-66467?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Cloudstack.