Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92761WebVirtCloud Missing Authorization on Instance Control Actions
High 8.8
In plain English
A high-severity missing authorization in webvirtcloud from retspen. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 50.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the get_instance gate that only checks grant existence.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| retspen | webvirtcloud | 1b2da68b2800f94674dd96f4a986cde30ac88280 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Issue #682 issue-tracking
- https://github.com/retspen/webvirtcloud product
- get_instance checks only that a grant exists, not its flags technical-description
- poweroff authorizes with get_instance alone technical-description
- resizevm_cpu shows the intended is_change enforcement technical-description
- VulnCheck Advisory: WebVirtCloud Missing Authorization on Instance Control Actions third-party-advisory