CVE-2026-61399

EUVD-2026-63838
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality.

This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 40.81%
Affected Products (NVD)
VendorProductVersion
apachecloudstack
4.20.0.0 ≤
𝑥
< 4.20.3.1
apachecloudstack
4.21.0.0 ≤
𝑥
< 4.22.1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc