Proxmox CVE

Missing privilege checks in GC status API

PSA-2026-00056-1 PBS

Affected packages

proxmox-backup-server

Details

Missing privilege checks in the GC status API endpoint at /api2/json/admin/gc/{store} allowed an authenticated attacker without sufficient privileges to know about a datastore's existence and its GC status.

This issue was discovered internally.

Fixed in

  • proxmox-backup-server >= 4.2.8-1

This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.