PBS backup access includes host/NNN groups

Details

If a configured PBS storage contained backup groups with type host, but numerical backup IDs, such snapshots were treated like guest backups despite their mismatching type.

An attacker with VM.Backup privilege on the "guest ID" and Datastore.AllocateSpace on the storage could trigger a file restore task or other actions on such a host backup.

This issue was reported privately by Project Loupe.

Fixed in

• libpve-storage-perl >= 9.1.11