---
id: CVE-2026-115376
title: >-
  Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via
  Custom Volume Copy
summary: >-
  Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization
  bypass vulnerability that allows project-restricted clients to copy volumes by
  omitting source.type. Attackers can send crafted POST requests to the custom
  volumes…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-284
vendor: lxc
product: incus
affected:
  - incus >= 7.0.1 < 7.0.2
  - incus >= 7.2.0 < 7.5.0
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:13:45.489Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115376'
references:
  - url: 'https://github.com/lxc/incus/security/advisories/GHSA-jh4v-j34r-2mgh'
    label: GitHub Security Advisory (GHSA-jh4v-j34r-2mgh)
  - url: >-
      https://www.vulncheck.com/advisories/incus-7.0.1-before-7.0.2-and-7.2.0-before-7.5.0-project-restriction-bypass-via-custom-volume-copy
    label: >-
      VulnCheck Advisory: Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0
      Project Restriction Bypass via Custom Volume Copy
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.402Z'
---

## Overview

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read other projects' volumes, snapshots, and configuration.

## Affected

- `incus >= 7.0.1 < 7.0.2`
- `incus >= 7.2.0 < 7.5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.