CVE 2013-4354
The API before 2.1 in OpenStack Image Registry and Delivery Service (Glance) makes it easier for local users to inject images into arbitrary tenants by adding the tenant as a member of the image.
See the 
CVE page on Mitre.org
for more details.
