CVE-2026-65613CWE-200CWE-284broken-access-controlinformation-disclosure

CVE-2026-65613

Medium · published August 21, 2026

CVSS v3.1

4.3

EPSS

Percentile

38.3

In the wild

Unconfirmed

What it is

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.

This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00452 · 38.3th percentile
Weaknesses: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-284 · Improper Access Control
Published: 2026-08-21T13:16Z

Affected products (2)

Product	Versions	Fixed in
apache/cloudstack	≥ 4.20.0.0, < 4.20.3.1	4.20.3.1
apache/cloudstack	≥ 4.21.0.0, < 4.22.1.1	4.22.1.1

References (1)

EPSS history

Timeline