Hi,

[ Reason ]
I would like to upload a fix for CVE-2026-93852 and CVE-2026-93854
through Trixie p-u.

[ Impact ]
As per upstream announce:
https://security.openstack.org/ossa/OSSA-2026-040.html

* In OpenStack Blazar before 17.0.1, the V2 lease listing
operation (GET /v2/leases) returns leases for every project without
enforcing project scoping or an administrator-only policy. Any
authenticated user with access to the Blazar REST API can enumerate leases
belonging to other tenants, exposing lease IDs, reservation IDs, resource
IDs, and reservation metadata. The exposed lease IDs also enable the
object-level authorization bypass tracked in the companion request,
allowing an attacker to then modify or delete the enumerated leases.

* In OpenStack Blazar before 17.0.1, the V2 lease API does
not enforce object-level authorization on its update and delete operations
(PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy
authorize() wrapper attempts to load the target lease to build the
authorization target from its owner, but it looks up the lease under the
keyword "lease_id" whereas the controller methods name the parameter "id"
(and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup
returns None, and thus authorization falls back to the requesting user's
own project_id/user_id instead of the target lease owner. Any authenticated
user who knows a lease ID can therefore modify or delete leases belonging
to other users and projects, bypassing the intended ownership check.


[ Tests ]
The included patch also modifes tests, which are used for this
part of the API, so it's covered.

There's also upstream functional testing.

[ Risks ]
Ok, because of upstream tests and unit tests.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Upstream patch.

Package is uploaded, and just need the Stable release team approval.

Cheers,

Thomas Goirand (zigo)