CyberSecBulletin

Retspen vulnerabilities

We track 2 vulnerabilities in Retspen products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2026.

2vulnerabilities
0critical
2high
0exploited
8.4average CVSS score

Latest Retspen vulnerabilities

  • 8.1 High severity

    webvirtcloud: Missing Authorization

    CVE-2026-122224Retspen

    WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to

  • 8.8 High severity

    webvirtcloud: Missing Authorization

    CVE-2026-92761Retspen

    WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO imag