{"id":"CVE-2026-71195","published":"2026-10-21T06:16:49.393","lastModified":"2026-10-22T17:36:46.950","description":"In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://launchpad.net/bugs/2161412","tags":[]},{"url":"https://openwall.com/lists/oss-security/2026/10/20/18","tags":[]},{"url":"https://security.openstack.org/ossa/OSSA-2026-046.html","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/18","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"In OpenStack Manila before 23.0.1, public shares lack proper authorization checks during API operations, allowing any authenticated user to perform unauthorized actions (e.g., access, backup, delete) on foreign public shares by exploiting share UUIDs visible in public listings.","exploitability":"Low effort for any authenticated project member; requires only knowledge of a public share's UUID and standard Manila API calls.","blast_radius":"An attacker can exfiltrate sensitive data via backups, escalate privileges through access rule manipulation, or disrupt availability by deleting or moving shares, affecting all tenants sharing public resources.","remediation":"Upgrade to OpenStack Manila 23.0.1 or later, which includes the required authorization checks for public share operations.","detection":"Log entries showing API calls (e.g., allow_access, create_share_backup) on public shares where the authenticated project ID does not match the share owner's project ID; monitor for unexpected access rule changes or backup creation events tied to foreign share UUIDs.","tags":["authorization-bypass","data-exfiltration","openstack","manila","public-share","cwe-863"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:49:13.287Z"}}