Missing enforcement of pool ACL when querying pool information
Affected packages
pve-manager
Details
It was possible to query information about a specific pool without the required Pool.Audit privilege.
This issue was found internally.
Fixed in
- pve-manager >= 9.2.23
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.