CVE-2026-93854

Overview

OpenStack Blazar's lease API fails to enforce object-level authorization on update/delete, allowing authenticated users to modify or delete leases of other projects if they know the lease ID. This bypasses intended ownership checks and can lead to unauthorized data tampering.

Description

In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy authorize() wrapper attempts to load the target lease to build the authorization target from its owner, but it looks up the lease under the keyword "lease_id" whereas the controller methods name the parameter "id" (and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup returns None, and thus authorization falls back to the requesting user's own project_id/user_id instead of the target lease owner. Any authenticated user who knows a lease ID can therefore modify or delete leases belonging to other users and projects, bypassing the intended ownership check.

Impact

Confidentiality: unauthorized users can view lease details. Integrity: they can alter lease attributes or delete leases. Availability: deletion may disrupt resource allocation. Affected parties: all users and projects using OpenStack Blazar leases.

Remediation

Upgrade to OpenStack Blazar 17.0.1 or later where the lease_id parameter is correctly used in authorization. If upgrade is not possible, restrict API access to trusted users, enforce project-level RBAC, or apply custom policy to block unauthorized updates/deletes.

Risk context

Severity high, CVSS v3 6.5, CVSS v4 7.2. No EPSS data. Urgent to patch due to potential cross-project data tampering.

Affected products

• OpenStack Blazar