CVE-2026-39910

The flaw

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines the

What to do

Review advisory and patch per vendor guidance.

References