CVE-2026-71195

{
  "etk_id": "ETK-2026-2292",
  "cve_id": "CVE-2026-71195",
  "display_id": "CVE-2026-71195",
  "ghsa_id": "GHSA-xm2x-8fhq-8hpv",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in OpenStack Manila public share APIs",
  "summary": "OpenStack Manila API operations on public shares can act on a share without confirming that the requester owns it. An authenticated project member may change share access or metadata, disrupt share lifecycle actions, obtain access-rule information, or create a backup of another project's public share when the share identifier is available.",
  "mitigation": "Upgrade Manila to 20.0.3, 21.0.3, 22.0.2, or 23.0.1, as appropriate for the deployed release branch. Until upgraded, limit or disable public shares and restrict access to Manila API endpoints to trusted project users.",
  "vendor": "OpenStack",
  "product": "Manila",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.0.0, < 20.0.3",
        ">= 21.0.0, < 21.0.3",
        ">= 22.0.0, < 22.0.2",
        ">= 23.0.0, < 23.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "20.0.3",
        "21.0.3",
        "22.0.2",
        "23.0.1"
      ],
      "package_name": "Manila",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 9.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.494266983333333,
  "t0_at": "2026-10-21T05:31:56.019000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T05:31:56.019000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T05:31:56.019000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71195"
    }
  }
}