In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy authorize() wrapper attempts to load the target lease to build the authorization target from its owner, but it looks up the lease under the keyword "lease_id" whereas the controller methods name the parameter "id" (and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup returns None, and thus authorization falls back to the requesting user's own project_id/user_id instead of the target lease owner. Any authenticated user who knows a lease ID can therefore modify or delete leases belonging to other users and projects, bypassing the intended ownership check.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Openstack |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://launchpad.net/bugs/2162719 |
|
History
Wed, 23 Sep 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Sat, 19 Sep 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Openstack
Openstack blazar |
|
| Vendors & Products |
Openstack
Openstack blazar |
Sat, 19 Sep 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | OpenStack Blazar Lease API Authorization Bypass Enables Authenticated Lease Modification |
Fri, 18 Sep 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy authorize() wrapper attempts to load the target lease to build the authorization target from its owner, but it looks up the lease under the keyword "lease_id" whereas the controller methods name the parameter "id" (and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup returns None, and thus authorization falls back to the requesting user's own project_id/user_id instead of the target lease owner. Any authenticated user who knows a lease ID can therefore modify or delete leases belonging to other users and projects, bypassing the intended ownership check. | |
| Weaknesses | CWE-1025 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2026-09-18T18:57:56.107Z
Updated: 2026-09-22T15:19:34.210Z
Reserved: 2026-09-18T18:57:50.302Z
Link: CVE-2026-93854
Vulnrichment
Updated: 2026-09-22T15:19:24.332Z
NVD
Status : Awaiting Analysis
Published: 2026-09-18T19:17:25.440
Modified: 2026-09-22T19:56:19.073
Link: CVE-2026-93854
Redhat
No data.