{"id":"EUVD-2026-39788","revision":"6d9d993eef514f08b93c396632a926b8","records":[{"revision":"6d9d993eef514f08b93c396632a926b8","observedAt":"2026-11-05T18:39:32.606+00:00","statement":{"source":"euvd","id":"EUVD-2026-39788","aliases":["CVE-2026-12411"],"title":"Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.…","description":"Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":8.4,"severity":null}],"references":["https://github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xp","https://github.com/canonical/lxd/pull/18585"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39788","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 26, 2026, 3:27:55 PM","dateUpdated":"Jun 26, 2026, 4:02:55 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-39788","identifiers":["EUVD-2026-39788","CVE-2026-12411"]},"retained":false,"historicalAffected":[]}],"coverage":[]}