github.com/lxc/incus/v7/cmd/incusd: Project restriction bypass for custom volume copy with omitted source type

Summary

Creating a custom storage volume with a source volume but no source.type is handled as a copy, but the source volume access check only applies when source.type is explicitly set to copy. A request that omits the type goes straight to the copy code path with a caller-controlled source.project.

Impact

Any client allowed to create custom volumes in a project can copy any custom volume from any other project on the server, including its snapshots and configuration, and read its contents, defeating project isolation.

Details

The POST /1.0/storage-pools/{pool}/volumes/custom endpoint only checks can_create_storage_volumes on the target project. The can_view check on the source volume added for CVE-2026-55621 lives in the copy arm of the source type switch, while the empty type arm calls the same copy helper without it. The official client always sets source.type to copy, so the empty form is only reachable through a crafted request.