Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5947 vulnerabilities reference this CWE, most recent first.
CVE-2026-73499 (GCVE-0-2026-73499)
Vulnerability from cvelistv5 – Published: 2026-08-12 21:20 – Updated: 2026-08-12 21:20
VLAI
EPSS
VEX
Title
etcd: Watch API authorization bypass via open-ended range requests
Summary
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/etcd-io/etcd/security/advisori… | x_refsource_CONFIRM |
| https://github.com/etcd-io/etcd/commit/6643f80602… | x_refsource_MISC |
| https://github.com/etcd-io/etcd/commit/7cf71ec9e2… | x_refsource_MISC |
| https://github.com/etcd-io/etcd/commit/afeaa624da… | x_refsource_MISC |
| https://github.com/etcd-io/etcd/commit/e863b001bb… | x_refsource_MISC |
| https://github.com/etcd-io/etcd/releases/tag/v3.5.33 | x_refsource_MISC |
| https://github.com/etcd-io/etcd/releases/tag/v3.6.14 | x_refsource_MISC |
| https://github.com/etcd-io/etcd/releases/tag/v3.7.1 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "etcd",
"vendor": "etcd-io",
"versions": [
{
"status": "affected",
"version": "\u003c 3.5.33"
},
{
"status": "affected",
"version": "\u003e= 3.6.0, \u003c 3.6.14"
},
{
"status": "affected",
"version": "\u003e= 3.7.0-alpha.0, \u003c 3.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T21:20:31.888Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8"
},
{
"name": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/etcd-io/etcd/commit/6643f80602461a6095c9b294b6512fd9719bef41"
},
{
"name": "https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/etcd-io/etcd/commit/7cf71ec9e2ec54230a5454392fa4ffd4574b41ed"
},
{
"name": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/etcd-io/etcd/commit/afeaa624da19085b47fb5ccc7c22a8c421bc2eae"
},
{
"name": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/etcd-io/etcd/commit/e863b001bbf3367003a543aa3099db9892134cd7"
},
{
"name": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/etcd-io/etcd/releases/tag/v3.5.33"
},
{
"name": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/etcd-io/etcd/releases/tag/v3.6.14"
},
{
"name": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/etcd-io/etcd/releases/tag/v3.7.1"
}
],
"source": {
"advisory": "GHSA-xg4h-6gfc-h4m8",
"discovery": "UNKNOWN"
},
"title": "etcd: Watch API authorization bypass via open-ended range requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73499",
"datePublished": "2026-08-12T21:20:31.888Z",
"dateReserved": "2026-08-12T19:00:33.736Z",
"dateUpdated": "2026-08-12T21:20:31.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73290 (GCVE-0-2026-73290)
Vulnerability from cvelistv5 – Published: 2026-08-12 14:46 – Updated: 2026-08-12 15:15
VLAI
EPSS
VEX
Title
RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback
Summary
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy_allowed path applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets, so a bucket that permits anonymous listing can continue exposing version listings after an operator enables the public-access control. The bypass affects GET /<bucket>?versions= and can disclose object version metadata even though equivalent GetObject requests are denied. This issue is fixed in version 1.0.0-beta.12.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 15:14 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rustfs/rustfs/security/advisor… | x_refsource_CONFIRM |
| https://github.com/rustfs/rustfs/commit/92f83bfe1… | x_refsource_MISC |
| https://github.com/rustfs/rustfs/releases/tag/1.0… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73290",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T15:14:50.737173Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:15:18.171Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-x298-9x87-fvjq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rustfs",
"vendor": "rustfs",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.0-beta.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy_allowed path applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets, so a bucket that permits anonymous listing can continue exposing version listings after an operator enables the public-access control. The bypass affects GET /\u003cbucket\u003e?versions= and can disclose object version metadata even though equivalent GetObject requests are denied. This issue is fixed in version 1.0.0-beta.12."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T14:46:20.042Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rustfs/rustfs/security/advisories/GHSA-x298-9x87-fvjq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-x298-9x87-fvjq"
},
{
"name": "https://github.com/rustfs/rustfs/commit/92f83bfe155d8a3b9cdd903086e5b28d52339efb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/commit/92f83bfe155d8a3b9cdd903086e5b28d52339efb"
},
{
"name": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.12"
}
],
"source": {
"advisory": "GHSA-x298-9x87-fvjq",
"discovery": "UNKNOWN"
},
"title": "RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73290",
"datePublished": "2026-08-12T14:46:20.042Z",
"dateReserved": "2026-08-11T19:42:11.450Z",
"dateUpdated": "2026-08-12T15:15:18.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73289 (GCVE-0-2026-73289)
Vulnerability from cvelistv5 – Published: 2026-08-12 14:43 – Updated: 2026-08-12 15:06
VLAI
EPSS
VEX
Title
RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions
Summary
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's semantics because crates/policy/src/policy/function/string.rs negates the aggregate result after eval or eval_like instead of negating each request-value predicate before quantification. Partially overlapping policy and request value sets can therefore make an Allow condition grant access to an excluded principal or make a Deny guardrail fail, including policies based on jwt:groups and jwt:roles; absent keys also receive the opposite ForAllValues: and ForAnyValue: behavior. This issue is fixed in version 1.0.0-beta.12.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 15:05 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rustfs/rustfs/security/advisor… | x_refsource_CONFIRM |
| https://github.com/rustfs/rustfs/commit/92f83bfe1… | x_refsource_MISC |
| https://github.com/rustfs/rustfs/releases/tag/1.0… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73289",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T15:05:40.691936Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:06:25.022Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rustfs",
"vendor": "rustfs",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.0-beta.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other\u0027s semantics because crates/policy/src/policy/function/string.rs negates the aggregate result after eval or eval_like instead of negating each request-value predicate before quantification. Partially overlapping policy and request value sets can therefore make an Allow condition grant access to an excluded principal or make a Deny guardrail fail, including policies based on jwt:groups and jwt:roles; absent keys also receive the opposite ForAllValues: and ForAnyValue: behavior. This issue is fixed in version 1.0.0-beta.12."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T14:43:58.710Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rustfs/rustfs/security/advisories/GHSA-v9cp-qfw9-9pfp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-v9cp-qfw9-9pfp"
},
{
"name": "https://github.com/rustfs/rustfs/commit/92f83bfe155d8a3b9cdd903086e5b28d52339efb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/commit/92f83bfe155d8a3b9cdd903086e5b28d52339efb"
},
{
"name": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.12"
}
],
"source": {
"advisory": "GHSA-v9cp-qfw9-9pfp",
"discovery": "UNKNOWN"
},
"title": "RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73289",
"datePublished": "2026-08-12T14:43:58.710Z",
"dateReserved": "2026-08-11T19:42:11.450Z",
"dateUpdated": "2026-08-12T15:06:25.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73286 (GCVE-0-2026-73286)
Vulnerability from cvelistv5 – Published: 2026-08-12 14:40 – Updated: 2026-08-12 15:17
VLAI
EPSS
VEX
Title
RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions
Summary
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_condition_values folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowing authenticated callers to satisfy identity-based policy conditions. This issue is fixed in version 1.0.0-beta.12.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 15:16 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rustfs/rustfs/security/advisor… | x_refsource_CONFIRM |
| https://github.com/rustfs/rustfs/commit/92f83bfe1… | x_refsource_MISC |
| https://github.com/rustfs/rustfs/blob/380ed40b471… | x_refsource_MISC |
| https://github.com/rustfs/rustfs/releases/tag/1.0… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73286",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T15:16:39.888927Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:17:00.723Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rustfs",
"vendor": "rustfs",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.0-beta.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_condition_values folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowing authenticated callers to satisfy identity-based policy conditions. This issue is fixed in version 1.0.0-beta.12."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T14:40:04.731Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rustfs/rustfs/security/advisories/GHSA-6r96-hmgc-726c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-6r96-hmgc-726c"
},
{
"name": "https://github.com/rustfs/rustfs/commit/92f83bfe155d8a3b9cdd903086e5b28d52339efb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/commit/92f83bfe155d8a3b9cdd903086e5b28d52339efb"
},
{
"name": "https://github.com/rustfs/rustfs/blob/380ed40b471887014fe21d069b61df9eacca074b/.agents/skills/security-advisory-lessons/references/advisory-patterns.md?plain=1#L45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/blob/380ed40b471887014fe21d069b61df9eacca074b/.agents/skills/security-advisory-lessons/references/advisory-patterns.md?plain=1#L45"
},
{
"name": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.12"
}
],
"source": {
"advisory": "GHSA-6r96-hmgc-726c",
"discovery": "UNKNOWN"
},
"title": "RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73286",
"datePublished": "2026-08-12T14:40:04.731Z",
"dateReserved": "2026-08-11T19:42:11.450Z",
"dateUpdated": "2026-08-12T15:17:00.723Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73285 (GCVE-0-2026-73285)
Vulnerability from cvelistv5 – Published: 2026-08-12 14:37 – Updated: 2026-08-12 15:11
VLAI
EPSS
VEX
Title
RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged
Summary
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values and allowing authenticated users to bypass tag-based policy restrictions. This issue is fixed in version 1.0.0-rc.1.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 15:07 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rustfs/rustfs/security/advisor… | x_refsource_CONFIRM |
| https://github.com/rustfs/rustfs/commit/98d361961… | x_refsource_MISC |
| https://github.com/rustfs/rustfs/blob/380ed40b471… | x_refsource_MISC |
| https://github.com/rustfs/rustfs/releases/tag/1.0… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73285",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T15:07:58.760961Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:11:01.651Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-5w8r-p896-6vq2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rustfs",
"vendor": "rustfs",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0-alpha.64, \u003c 1.0.0-rc.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values and allowing authenticated users to bypass tag-based policy restrictions. This issue is fixed in version 1.0.0-rc.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T14:37:42.271Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rustfs/rustfs/security/advisories/GHSA-5w8r-p896-6vq2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-5w8r-p896-6vq2"
},
{
"name": "https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d"
},
{
"name": "https://github.com/rustfs/rustfs/blob/380ed40b471887014fe21d069b61df9eacca074b/.agents/skills/security-advisory-lessons/references/advisory-patterns.md?plain=1#L47",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/blob/380ed40b471887014fe21d069b61df9eacca074b/.agents/skills/security-advisory-lessons/references/advisory-patterns.md?plain=1#L47"
},
{
"name": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1"
}
],
"source": {
"advisory": "GHSA-5w8r-p896-6vq2",
"discovery": "UNKNOWN"
},
"title": "RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73285",
"datePublished": "2026-08-12T14:37:42.271Z",
"dateReserved": "2026-08-11T19:42:11.450Z",
"dateUpdated": "2026-08-12T15:11:01.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73265 (GCVE-0-2026-73265)
Vulnerability from cvelistv5 – Published: 2026-08-12 14:33 – Updated: 2026-08-12 14:33
VLAI
EPSS
VEX
Title
RustFS: Version-specific object reads authorize the non-version action
Summary
RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content. This issue is fixed in version 1.0.0-beta.11.
Severity
6.5 (Medium)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rustfs/rustfs/security/advisor… | x_refsource_CONFIRM |
| https://github.com/rustfs/rustfs/pull/5142 | x_refsource_MISC |
| https://github.com/rustfs/rustfs/commit/816656170… | x_refsource_MISC |
| https://github.com/rustfs/rustfs/releases/tag/1.0… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "rustfs",
"vendor": "rustfs",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.0-beta.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content. This issue is fixed in version 1.0.0-beta.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T14:33:04.002Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rustfs/rustfs/security/advisories/GHSA-3ppv-fx5m-m749",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-3ppv-fx5m-m749"
},
{
"name": "https://github.com/rustfs/rustfs/pull/5142",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/pull/5142"
},
{
"name": "https://github.com/rustfs/rustfs/commit/81665617029e5e437ecf9dc70d8dcbbbf80cdbd1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/commit/81665617029e5e437ecf9dc70d8dcbbbf80cdbd1"
},
{
"name": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.11"
}
],
"source": {
"advisory": "GHSA-3ppv-fx5m-m749",
"discovery": "UNKNOWN"
},
"title": "RustFS: Version-specific object reads authorize the non-version action"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73265",
"datePublished": "2026-08-12T14:33:04.002Z",
"dateReserved": "2026-08-11T17:18:01.599Z",
"dateUpdated": "2026-08-12T14:33:04.002Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73221 (GCVE-0-2026-73221)
Vulnerability from cvelistv5 – Published: 2026-08-11 18:22 – Updated: 2026-08-11 20:04
VLAI
EPSS
VEX
Title
CVAT: Flawed authorization logic in endpoints related to lambda requests
Summary
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 20:04 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/cvat-ai/cvat/security/advisori… | x_refsource_CONFIRM |
| https://github.com/cvat-ai/cvat/pull/10964 | x_refsource_MISC |
| https://github.com/cvat-ai/cvat/commit/20a1076a0b… | x_refsource_MISC |
| https://github.com/cvat-ai/cvat/releases/tag/v2.72.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73221",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T20:04:34.958132Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T20:04:53.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cvat",
"vendor": "cvat-ai",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.17.0, \u003c 2.72.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T18:22:10.737Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/cvat-ai/cvat/security/advisories/GHSA-m7p7-6w4m-886p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/cvat-ai/cvat/security/advisories/GHSA-m7p7-6w4m-886p"
},
{
"name": "https://github.com/cvat-ai/cvat/pull/10964",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cvat-ai/cvat/pull/10964"
},
{
"name": "https://github.com/cvat-ai/cvat/commit/20a1076a0b9de47e067b121e40f16d66d373b3f7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cvat-ai/cvat/commit/20a1076a0b9de47e067b121e40f16d66d373b3f7"
},
{
"name": "https://github.com/cvat-ai/cvat/releases/tag/v2.72.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cvat-ai/cvat/releases/tag/v2.72.0"
}
],
"source": {
"advisory": "GHSA-m7p7-6w4m-886p",
"discovery": "UNKNOWN"
},
"title": "CVAT: Flawed authorization logic in endpoints related to lambda requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73221",
"datePublished": "2026-08-11T18:22:10.737Z",
"dateReserved": "2026-08-11T14:41:20.122Z",
"dateUpdated": "2026-08-11T20:04:53.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73213 (GCVE-0-2026-73213)
Vulnerability from cvelistv5 – Published: 2026-08-11 17:33 – Updated: 2026-08-11 17:33
VLAI
EPSS
VEX
Title
Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF)
Summary
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/coturn/coturn/security/advisor… | x_refsource_CONFIRM |
| https://github.com/coturn/coturn/commit/6c13608c2… | x_refsource_MISC |
| https://github.com/coturn/coturn/releases/tag/4.16.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "coturn",
"vendor": "coturn",
"versions": [
{
"status": "affected",
"version": "\u003c 4.16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:33:12.757Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/coturn/coturn/security/advisories/GHSA-4v97-rxjj-4f99",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/coturn/coturn/security/advisories/GHSA-4v97-rxjj-4f99"
},
{
"name": "https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28"
},
{
"name": "https://github.com/coturn/coturn/releases/tag/4.16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/coturn/coturn/releases/tag/4.16.0"
}
],
"source": {
"advisory": "GHSA-4v97-rxjj-4f99",
"discovery": "UNKNOWN"
},
"title": "Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73213",
"datePublished": "2026-08-11T17:33:12.757Z",
"dateReserved": "2026-08-11T14:41:20.121Z",
"dateUpdated": "2026-08-11T17:33:12.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73090 (GCVE-0-2026-73090)
Vulnerability from cvelistv5 – Published: 2026-08-11 17:19 – Updated: 2026-08-11 17:19
VLAI
EPSS
VEX
Title
PeerTube: Cross-origin remote video takeover via Update activity
Summary
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.
Severity
9.3 (Critical)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Chocobozzz/PeerTube/security/a… | x_refsource_CONFIRM |
| https://github.com/Chocobozzz/PeerTube/commit/63d… | x_refsource_MISC |
| https://github.com/Chocobozzz/PeerTube/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Chocobozzz | PeerTube |
Affected:
< 8.2.2
|
{
"containers": {
"cna": {
"affected": [
{
"product": "PeerTube",
"vendor": "Chocobozzz",
"versions": [
{
"status": "affected",
"version": "\u003c 8.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server\u0027s video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:19:30.272Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/commit/63d487d2a4a2a0e36af8c0ccb888cd23725bf7f2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/commit/63d487d2a4a2a0e36af8c0ccb888cd23725bf7f2"
},
{
"name": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2"
}
],
"source": {
"advisory": "GHSA-g9p4-f7h8-hc86",
"discovery": "UNKNOWN"
},
"title": "PeerTube: Cross-origin remote video takeover via Update activity"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73090",
"datePublished": "2026-08-11T17:19:30.272Z",
"dateReserved": "2026-08-10T19:37:41.445Z",
"dateUpdated": "2026-08-11T17:19:30.272Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72921 (GCVE-0-2026-72921)
Vulnerability from cvelistv5 – Published: 2026-08-11 14:28 – Updated: 2026-08-11 14:28
VLAI
EPSS
VEX
Title
SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
Summary
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.
Severity
8.1 (High)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/seaweedfs/seaweedfs/security/a… | x_refsource_CONFIRM |
| https://github.com/seaweedfs/seaweedfs/pull/9439 | x_refsource_MISC |
| https://github.com/seaweedfs/seaweedfs/commit/05e… | x_refsource_MISC |
| https://github.com/seaweedfs/seaweedfs/releases/t… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "seaweedfs",
"vendor": "seaweedfs",
"versions": [
{
"status": "affected",
"version": "\u003c 4.24"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T14:28:49.398Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-gv5w-hfx8-8cwq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-gv5w-hfx8-8cwq"
},
{
"name": "https://github.com/seaweedfs/seaweedfs/pull/9439",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/seaweedfs/seaweedfs/pull/9439"
},
{
"name": "https://github.com/seaweedfs/seaweedfs/commit/05ed5c9ae8a2a45101b52b61d02f170d20d587ff",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/seaweedfs/seaweedfs/commit/05ed5c9ae8a2a45101b52b61d02f170d20d587ff"
},
{
"name": "https://github.com/seaweedfs/seaweedfs/releases/tag/4.24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/seaweedfs/seaweedfs/releases/tag/4.24"
}
],
"source": {
"advisory": "GHSA-gv5w-hfx8-8cwq",
"discovery": "UNKNOWN"
},
"title": "SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72921",
"datePublished": "2026-08-11T14:28:49.398Z",
"dateReserved": "2026-08-10T17:57:26.144Z",
"dateUpdated": "2026-08-11T14:28:49.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.