Hi,

The following vulnerabilities were published for blazar.

CVE-2026-93852[0]:
| In OpenStack Blazar before 17.0.1, the V2 lease listing operation
| (GET /v2/leases) returns leases for every project without enforcing
| project scoping or an administrator-only policy. Any authenticated
| user with access to the Blazar REST API can enumerate leases
| belonging to other tenants, exposing lease IDs, reservation IDs,
| resource IDs, and reservation metadata. The exposed lease IDs also
| enable the object-level authorization bypass tracked in the
| companion request, allowing an attacker to then modify or delete the
| enumerated leases.


CVE-2026-93854[1]:
| In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce
| object-level authorization on its update and delete operations (PUT
| /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy
| authorize() wrapper attempts to load the target lease to build the
| authorization target from its owner, but it looks up the lease under
| the keyword "lease_id" whereas the controller methods name the
| parameter "id" (and the wsme_pecan.wsexpose wrapper delivers it
| positionally). The lookup returns None, and thus authorization falls
| back to the requesting user's own project_id/user_id instead of the
| target lease owner. Any authenticated user who knows a lease ID can
| therefore modify or delete leases belonging to other users and
| projects, bypassing the intended ownership check.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-93852
https://www.cve.org/CVERecord?id=CVE-2026-93852
[1] https://security-tracker.debian.org/tracker/CVE-2026-93854
https://www.cve.org/CVERecord?id=CVE-2026-93854
[2] https://launchpad.net/bugs/2162719

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1148408 in blazar reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/blazar/-/commit/d0b737c81d57632db50304701335f42a329824ff
------------------------------------------------------------------------
* CVE-2026-93852: In OpenStack Blazar before 17.0.1, the V2 lease listing
    operation (GET /v2/leases) returns leases for every project without
    enforcing project scoping or an administrator-only policy. Any
    authenticated user with access to the Blazar REST API can enumerate leases
    belonging to other tenants, exposing lease IDs, reservation IDs, resource
    IDs, and reservation metadata. The exposed lease IDs also enable the
    object-level authorization bypass tracked in the companion request,
    allowing an attacker to then modify or delete the enumerated leases.
    .
    CVE-2026-93854: In OpenStack Blazar before 17.0.1, the V2 lease API does
    not enforce object-level authorization on its update and delete operations
    (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy
    authorize() wrapper attempts to load the target lease to build the
    authorization target from its owner, but it looks up the lease under the
    keyword "lease_id" whereas the controller methods name the parameter "id"
    (and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup
    returns None, and thus authorization falls back to the requesting user's
    own project_id/user_id instead of the target lease owner. Any authenticated
    user who knows a lease ID can therefore modify or delete leases belonging
    to other users and projects, bypassing the intended ownership check.
    .
    Applied upstream patch (Closes: #1148408).
    - CVE-2026-93852_CVE-2026-93854_Fix_v2_API_object-level_authorizat....patch
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1148408

Hello,

Bug #1148408 in blazar reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/blazar/-/commit/a3806844da6e1af92d4a13f3d56cbd16dab6349d
------------------------------------------------------------------------
* CVE-2026-93852: In OpenStack Blazar before 17.0.1, the V2 lease listing
    operation (GET /v2/leases) returns leases for every project without
    enforcing project scoping or an administrator-only policy. Any
    authenticated user with access to the Blazar REST API can enumerate leases
    belonging to other tenants, exposing lease IDs, reservation IDs, resource
    IDs, and reservation metadata. The exposed lease IDs also enable the
    object-level authorization bypass tracked in the companion request,
    allowing an attacker to then modify or delete the enumerated leases.
    .
    CVE-2026-93854: In OpenStack Blazar before 17.0.1, the V2 lease API does
    not enforce object-level authorization on its update and delete operations
    (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy
    authorize() wrapper attempts to load the target lease to build the
    authorization target from its owner, but it looks up the lease under the
    keyword "lease_id" whereas the controller methods name the parameter "id"
    (and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup
    returns None, and thus authorization falls back to the requesting user's
    own project_id/user_id instead of the target lease owner. Any authenticated
    user who knows a lease ID can therefore modify or delete leases belonging
    to other users and projects, bypassing the intended ownership check.
    .
    Applied upstream patch (Closes: #1148408).
    - CVE-2026-93852_CVE-2026-93854_Fix_v2_API_object-level_authorizat....patch
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1148408

We believe that the bug you reported is fixed in the latest version of
blazar, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148408@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated blazar package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 21 Sep 2026 17:37:21 +0200
Source: blazar
Architecture: source
Version: 18.0.0~rc1-3
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1148408
Changes:
 blazar (18.0.0~rc1-3) unstable; urgency=medium
 .
   * CVE-2026-93852: In OpenStack Blazar before 17.0.1, the V2 lease listing
     operation (GET /v2/leases) returns leases for every project without
     enforcing project scoping or an administrator-only policy. Any
     authenticated user with access to the Blazar REST API can enumerate leases
     belonging to other tenants, exposing lease IDs, reservation IDs, resource
     IDs, and reservation metadata. The exposed lease IDs also enable the
     object-level authorization bypass tracked in the companion request,
     allowing an attacker to then modify or delete the enumerated leases.
     .
     CVE-2026-93854: In OpenStack Blazar before 17.0.1, the V2 lease API does
     not enforce object-level authorization on its update and delete operations
     (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy
     authorize() wrapper attempts to load the target lease to build the
     authorization target from its owner, but it looks up the lease under the
     keyword "lease_id" whereas the controller methods name the parameter "id"
     (and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup
     returns None, and thus authorization falls back to the requesting user's
     own project_id/user_id instead of the target lease owner. Any authenticated
     user who knows a lease ID can therefore modify or delete leases belonging
     to other users and projects, bypassing the intended ownership check.
     .
     Applied upstream patch (Closes: #1148408).
     - CVE-2026-93852_CVE-2026-93854_Fix_v2_API_object-level_authorizat....patch
Checksums-Sha1:
 12be7ae28b56b701fe1018673bbd2e7f6c4e2bcc 3218 blazar_18.0.0~rc1-3.dsc
 14a63674056f6e8a0b425fd6dabf435618fd060f 9668 blazar_18.0.0~rc1-3.debian.tar.xz
 a11938f72ce71e4fa65ca26efe2ad150bd126167 14968 blazar_18.0.0~rc1-3_amd64.buildinfo
Checksums-Sha256:
 8ef07aec5f5796b439e2f3623e6ca8194b86400f28e0e323957feebbe52b4263 3218 blazar_18.0.0~rc1-3.dsc
 87abd72db1a4ed08b2ab0b0163b0c8e345a3dd70851939fc00ff26d832f5f761 9668 blazar_18.0.0~rc1-3.debian.tar.xz
 15a51999c4f2f632783c45ddec05b15f4e0d5eac34c397551ea29000bbc8981f 14968 blazar_18.0.0~rc1-3_amd64.buildinfo
Files:
 db83949aa1fd9f97313e17a0a67ed6e7 3218 web optional blazar_18.0.0~rc1-3.dsc
 9fae86a410e79ff6cf717458a1bdc275 9668 web optional blazar_18.0.0~rc1-3.debian.tar.xz
 c08fad2be2ad27eea9d670e354373a31 14968 web optional blazar_18.0.0~rc1-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmqxUSQACgkQ1BatFaxr
Q/4K6BAAnJTLU4vHh4QFAS/RtH/0Uc09frvCVzT+LKhNV7o+8hUpSxjnA0UchAn7
vBMGdkhtIBdgkzLbH+2Vb7KMCxMx13BQHGWv+WYPgPGVDswn6/T6kjTfaUCY6jAb
gh+PpsCAtsNCMpgSQf0BFeyo1zAYeP3tLMokDr/p3H0ifMosnzFcqTabw7/252cL
GBnGnyspl2pK6G+hgza5FxveupZ4b0cSgC3gNgleO5PRF0Mh5yIrorQbyc6qzM6W
uFEJjhweVb3e+tdPRUsrGOUwkwa9aEraGF4tWy+YHfW1gWEGWj32/hh4EhfyGcav
Qkvvl3dT5BVYk5h+uErWPNtKCw7VMmMFEl5AXP7w46qqZNdJgpKsk0HGnpdsreIi
RcfhKKg/R1EJsZv8Pij92L/A9IjhkC77bM65I91rjXburgNiFNA/KEpxWRo4+Idh
FpSrCxSp6G4mCVvPIQAPELvSUvno2bYInSgbdaF0oLUTsiqM1zZb0+Irrc9Z/SMn
6pDymMmXkBUb2xj7HckjumI9sv5ViGecCzUcwKm+ZWArfrgYXAkalRvMTtykBMqi
4/8Ep2ierveibpUD+KsoHPWHYZaIVG/fxO+/AOmrTCBlTPPj2mSAun1W2wFmVBMP
NYuDne0PHzZIqSGzvSfp9iVqCV7zU+WBSib2dB8Sux7ZnDGTaZU=
=qds7
-----END PGP SIGNATURE-----