CVE-2026-61399

Summary

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality.

This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Affected Software

VendorProductVersion RangeStatus
Apache Software FoundationApache CloudStack4.20.0.0 <= 4.20.3.0affected
Apache Software FoundationApache CloudStack4.21.0.0 <= 4.22.1.0affected

Weaknesses

  • CWE-116: CWE-116 Improper Encoding or Escaping of Output

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References