An authorization bypass vulnerability in Apache CloudStack allows Domain Admins to manipulate project roles outside their assigned scope, posing a significant risk to multi-tenant infrastructure integrity.

This vulnerability is caused by improper authorization (CWE-285) during CRUD operations on Project Roles. The system validates that a caller possesses the Domain Admin role but fails to verify if the target project resides within the administrator's authorized domain or subdomain.

A successful exploit permits a malicious Domain Admin to escalate their influence by modifying or deleting project roles and permissions in domains they do not control. Given the CVSS score of 7.2, this vulnerability represents a high risk to organizational data integrity and multi-tenant isolation, potentially facilitating unauthorized administrative access or service disruption across the entire cloud environment.

Immediate Action: Upgrade Apache CloudStack to version 4.20.3.1 or 4.22.1.1, as these releases contain the necessary authorization checks to restrict administrative actions to appropriate domains.

Proactive Monitoring: Review administrative access logs for unusual activity involving project role modifications, specifically monitoring for attempts to manage projects that do not belong to the primary domain of the executing administrator.

Compensating Controls: Implement strict Role Based Access Control (RBAC) policies and limit the number of users granted the Domain Admin privilege until the software can be patched.

Public Exploit Available: Unknown

Due to the high severity and potential for cross-domain privilege escalation, organizations should prioritize patching their Apache CloudStack instances. Administrators must treat this as a critical security update and coordinate a maintenance window to apply the vendor-supplied fix as soon as possible to maintain proper multi-tenant isolation.