CVE-2026-71195Published

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public s…

Exact source revision recorded 27 Oct 2026 23:45:55 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-71195

Published

Manila

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "defaultStatus": "unaffected",
                    "product": "Manila",
                    "repo": "https://opendev.org/openstack/manila",
                    "vendor": "OpenStack",
                    "versions": [
                        {
                            "lessThan": "20.0.3",
                            "status": "affected",
                            "version": "1.0.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "21.0.3",
                            "status": "affected",
                            "version": "21.0.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "22.0.2",
                            "status": "affected",
                            "version": "22.0.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "23.0.1",
                            "status": "affected",
                            "version": "23.0.0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON