CVE-2026-92761: WebVirtCloud Privilege Escalation Flaw

CVE-2026-92761 Overview

CVE-2026-92761 is a missing authorization vulnerability [CWE-862] in WebVirtCloud, an open-source web interface for managing KVM virtual machines. The flaw resides in the get_instance gate within instances/views.py, which only checks whether a UserInstance grant exists. It does not validate the permission flags attached to that grant. Any authenticated user with a read-only grant on a virtual machine can invoke privileged control actions. Attackers can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images without holding administrative rights.

Critical Impact
Authenticated users with view-only grants can seize full control of virtual machines, including credential reset and SSH key injection, leading to guest-level compromise.

Affected Products

WebVirtCloud (retspen/webvirtcloud) — commit 1b2da68b2800f94674dd96f4a986cde30ac88280 and prior versions containing the vulnerable get_instance authorization gate
Deployments exposing the instances Django views to multi-tenant users
Environments granting non-administrative users UserInstance records for shared virtual machines

Discovery Timeline

2026-09-16 - CVE-2026-92761 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92761

Vulnerability Analysis

WebVirtCloud enforces per-VM access using UserInstance records that associate a user with an instance and carry boolean flags such as power management, console access, and settings modification. The get_instance helper in instances/views.py (see lines 316-330) validates only that a grant exists between the authenticated user and the requested VM. Downstream action handlers, including those at lines 356-363 and lines 538-546, inherit that permissive check and never re-verify the specific privilege flag required for the operation. The result is a broken access control condition where read-only users execute state-changing operations.

Root Cause

The root cause is missing authorization on instance control actions. The application conflates authentication of a grant with authorization for a specific action. Permission flags on the UserInstance model exist in the schema but are not enforced in the view layer. Any grant, regardless of scope, functions as full authorization.

Attack Vector

An attacker requires a valid WebVirtCloud account and any UserInstance grant on a target VM. The attacker sends HTTP requests to the instance action endpoints, such as power control, root password reset, SSH key installation, and ISO management. The server processes the request because get_instance returns the instance object without inspecting the granular permission flags. See the VulnCheck advisory and GitHub issue #682 for additional technical detail.

// No verified proof-of-concept code is available.
// The vulnerability is triggered by issuing standard authenticated
// POST requests to instance action endpoints (power, resetpass,
// sshkey, iso management) from an account holding any UserInstance grant.

Detection Methods for CVE-2026-92761

Indicators of Compromise

Unexpected virtual machine power-off, reboot, or reset events initiated by non-administrative user accounts
Root password reset or SSH public key installation actions performed by users without administrator roles
ISO image mount, unmount, or upload operations invoked by accounts holding only read-only grants
Guest operating system logins from newly injected SSH keys tied to WebVirtCloud user activity

Detection Strategies

Audit WebVirtCloud application logs and Django request logs for POST requests to instance action URLs correlated to users whose UserInstance grants lack the corresponding permission flag
Compare the acting user's UserInstance permission flags against the action performed to identify authorization drift
Baseline normal administrative activity per VM, then alert on state-changing actions performed outside that baseline

Monitoring Recommendations

Forward WebVirtCloud web server and Django logs to a centralized logging platform for correlation with guest VM events
Monitor libvirt and hypervisor audit trails for VM lifecycle changes and match them to originating web sessions
Alert on any successful resetpass, sshkey, or iso action performed by an account without an explicit administrator role

How to Mitigate CVE-2026-92761

Immediate Actions Required

Restrict WebVirtCloud access to trusted administrators until a patched build is deployed, and revoke non-essential UserInstance grants
Rotate root passwords and audit authorized_keys on all guest VMs managed by WebVirtCloud to remove attacker-injected credentials
Place the WebVirtCloud management interface behind a VPN or network access control list to limit exposure

Patch Information

At time of publication, refer to the WebVirtCloud GitHub repository and issue #682 for remediation status. A complete fix requires enforcing the specific UserInstance permission flag inside every action handler in instances/views.py, not only within the get_instance gate. Review the VulnCheck advisory for coordinated disclosure updates.

Workarounds

Remove all non-administrator UserInstance grants until authorization checks are added to the affected action handlers
Deploy a reverse proxy rule that blocks non-administrator users from reaching instance action endpoints such as power, resetpass, sshkey, and iso routes
Segment the WebVirtCloud host and managed hypervisors on a dedicated management network to reduce reachable attackers

bash

# Example NGINX rule restricting instance action endpoints to admin IP ranges
location ~ ^/instances/[0-9]+/(power|resetpass|sshkey|iso) {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://webvirtcloud_upstream;
}