{"affected":[{"product":"incus","source":"CNA: GitHub_M","vendor":"lxc","versions":[{"status":"affected","version":"< 7.2.0"}]},{"product":"lxd","source":"CNA: GitHub_M","vendor":"canonical","versions":[{"status":"affected","version":">= 4.12.0, < 5.0.7"},{"status":"affected","version":">= 5.1.0, 5.21.5"},{"status":"affected","version":">= 6.0.0, < 6.8.0"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/lxc/incus/v7","product":"github.com/lxc/incus/v7","source":"OSV GHSA-64f3-v33m-w89f","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"7.2.0"}],"lessThan":"7.2.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/lxc/incus/v6","product":"github.com/lxc/incus/v6","source":"OSV GHSA-64f3-v33m-w89f","vendor":"","versions":[{"events":[{"introduced":"0"},{"last_affected":"6.23.0"}],"lessThanOrEqual":"6.23.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/lxc/incus","product":"github.com/lxc/incus","source":"OSV GHSA-64f3-v33m-w89f","vendor":"","versions":[{"events":[{"introduced":"0"},{"last_affected":"0.7.0"}],"lessThanOrEqual":"0.7.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-55621","cwes":["CWE-284"],"description":"Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue.","epss":{"date":"2026-11-05","percentile":0.27676,"score":0.0034},"exploits":[],"kev":null,"metrics":[{"score":7.7,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793922523471,"publishedAt":1787323183775,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/canonical/lxd/security/advisories/GHSA-7mr3-28h5-m5vx"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/lxc/incus/releases/tag/v7.2.0"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-64f3-v33m-w89f"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-64f3-v33m-w89f"}],"remediation":[{"kind":"fix","source":"OSV GHSA-64f3-v33m-w89f","text":"github.com/lxc/incus/v7 (Go): OSV reports a fixed version 7.2.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-64f3-v33m-w89f"}],"revision":"1343305b5573837e3d56b3ba4d45ede3c2a3c035ffc78f1bea3fa1d2e214a1dd","sources":[{"modifiedAt":1793922523471,"name":"CNA: GitHub_M","retrievedAt":1793923709976,"url":"https://www.cve.org/CVERecord?id=CVE-2026-55621"},{"modifiedAt":1793916004116,"name":"OSV / GitHub Security Advisories (partial: 1/2 referenced advisories verified)","retrievedAt":1793917151757,"url":"https://osv.dev/vulnerability/GHSA-64f3-v33m-w89f"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793917158826,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55621"}],"ssvc":{"assessedAt":1787330468846,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Incus has a project restriction bypass for custom volume copy across projects","updatedAt":1793923709976}