EUVD-2026-66770Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network-exposed S3 API; requires low-privilege auth credential; no confidentiality impact; integrity is high as full object overwrite occurs; availability is low due to incidental data destruction.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope by calling PutObjectAcl on the key it is allowed to access. The handler authorizes the request against the requested nested key but then writes the updated entry back to the bucket root rather than the key's actual parent directory, so an ACL change on allowed/protected.txt is instead applied to protected.txt at the bucket root. Because the update carries the full entry rather than only ACL metadata, an existing target object is overwritten with the content, metadata, owner information, and ACL of the scoped object, bypassing the object-level action scoping configured through the static S3 identity file. This issue is fixed in version 4.40.
AnalysisAI
Incorrect authorization in SeaweedFS S3 API's PutObjectAcl handler allows an authenticated low-privilege S3 principal to overwrite objects outside their permission scope. Versions prior to 4.40 compute the write-back directory from the bucket root rather than the actual parent directory of the nested key, meaning a principal scoped to allowed/protected.txt silently overwrites protected.txt at the bucket root - clobbering its content, metadata, owner, and ACL. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid SeaweedFS S3 API credential with at least PutObjectAcl permission on a nested object key (e.g., `prefix/filename.ext`); (2) the deployment must use the static S3 identity file to configure object-level action scoping that grants access to a nested path; (3) a target object must exist at the bucket root sharing the same basename as the attacker's scoped nested key (e.g., root-level `filename.ext`). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) reflects a network-exploitable, low-complexity flaw requiring only a valid low-privilege S3 credential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operating as a low-privilege S3 tenant scoped only to `tenant-uploads/report.csv` calls `PutObjectAcl` on that key with a crafted ACL body. The handler authorizes the request correctly, but resolves the write-back directory to the bucket root and overwrites `report.csv` at the root level - replacing a different user's or administrator's object with the attacker's own content, metadata, and ACL grants. … |
| Remediation | Upgrade to SeaweedFS version 4.40, which contains the fix in commit 311bc3a6dfbd042751692bc3de8accc516fcf8c1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SeaweedFS deployments running versions prior to 4.40 and assess exposure to users with low-privilege credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery with response read-back in SeaweedFS distributed storage (versions prior to 4.24) lets anyon
Cross-bucket read/write in SeaweedFS before 4.30 lets remote attackers escape a bucket's namespace because the S3 API ga
Cross-tenant object deletion in SeaweedFS before 4.34 lets an authenticated S3 principal holding write access to just on
Authentication bypass in SeaweedFS filer before 4.24 exposes the SeaweedIdentityAccessManagement gRPC service without an
Authorization bypass in SeaweedFS versions 4.39 and earlier allows authenticated federated users to assume IAM roles the
Cross-tenant authorization bypass in SeaweedFS filer JWT path authorization allows any authenticated tenant to read and
Incorrect path authorization in SeaweedFS SFTP server (versions 3.88-4.39) allows an authenticated low-privilege user to
SeaweedFS 4.39's TUS resumable-upload handler fails to re-validate JWT prefix scoping on HEAD, PATCH, and DELETE operati
Unvalidated JSONP callback reflection in SeaweedFS before 4.30 enables cross-origin reads of cluster topology, volume se
seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_sto
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today