{"schema":"threatline.record/2","record":{"id":"GHSA-jh4v-j34r-2mgh","aliases":["GHSA-jh4v-j34r-2mgh"],"summary":"Project restriction bypass for custom volume copy with omitted source type","details":"### Summary\r\n\r\nCreating a custom storage volume with a `source` volume but no `source.type`\r\nis handled as a copy, but the source volume access check only applies when\r\n`source.type` is explicitly set to `copy`. A request that omits the type goes\r\nstraight to the copy code path with a caller-controlled `source.project`.\r\n\r\n### Impact\r\n\r\nAny client allowed to create custom volumes in a project can copy any custom\r\nvolume from any other project on the server, including its snapshots and\r\nconfiguration, and read its contents, defeating project isolation.\r\n\r\n### Details\r\n\r\nThe `POST /1.0/storage-pools/{pool}/volumes/custom` endpoint only checks\r\n`can_create_storage_volumes` on the target project. The `can_view` check on\r\nthe source volume added for CVE-2026-55621 lives in the `copy` arm of the\r\nsource type switch, while the empty type arm calls the same copy helper\r\nwithout it. The official client always sets `source.type` to `copy`, so the\r\nempty form is only reachable through a crafted request.","categories":["Unclassified"],"product":"github.com/lxc/incus/v7/cmd/incusd","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/lxc/incus/security/advisories/GHSA-jh4v-j34r-2mgh","source_modified_at":"2026-09-25T00:54:12Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"go","name":"github.com/lxc/incus/v7/cmd/incusd"},"range":"< v7.5.0"}],"fixed_versions":[],"cvss":7.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-25T00:54:12Z","modified_at":"2026-09-25T00:54:12Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/lxc/incus/security/advisories/GHSA-jh4v-j34r-2mgh","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-25T00:54:12Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-25T00:54:12Z","content_hash":"703d8658e3de28a115fa1cb00cc2146c172d9169cec5c0665ef51ec23afbe73b"}}