A missing authorization vulnerability in Apache CloudStack allows unauthenticated attackers to potentially access sensitive cross-tenant userdata, posing a significant risk to data confidentiality.

The vulnerability exists within several API functions, including deleteUserData and deployVirtualMachine, where insufficient access control validation allows an unauthenticated user to interact with resources belonging to other tenants.

The exposure of sensitive userdata across tenant boundaries represents a severe breach of multi-tenant security architecture. Given the CVSS score of 7.5, this high-severity flaw could lead to the unauthorized retrieval of configuration secrets, credentials, or other private data stored within virtual machine userdata, potentially compromising the entire cloud infrastructure hosted on the platform.

Immediate Action: Administrators must upgrade Apache CloudStack to version 4.20.3.1 or 4.22.1.1 or later to implement the necessary access control patches.

Proactive Monitoring: Security teams should review API access logs for anomalous requests to userdata endpoints that originate from unauthorized tenant accounts.

Compensating Controls: If immediate patching is not feasible, restrict access to the CloudStack management API at the network level to known, trusted management segments.

Public Exploit Available: Unknown.

The severity of this vulnerability, combined with the ease of potential exploitation through standard API calls, necessitates an urgent update schedule. Organizations utilizing Apache CloudStack in multi-tenant environments should prioritize patching to prevent unauthorized cross-account data access and maintain the integrity of their cloud infrastructure.