Storagegrid Formerly Storagegrid Webscale EUVD-2026-23952

Attacker must possess valid, authenticated credentials with at least low-level privileges on the StorageGRID system-no unauthenticated exploitation is possible (PR:L requirement). The metrics query interface must be accessible via network (AV:N), which is typical in admin and API configurations. Exploitation requires specific timing or transient conditions (AT:P), meaning the attack is not unconditionally repeatable and depends on system state or query scheduling windows-details of this timing dependency are not specified in the provided description, limiting precise exploitation forecasting. Vulnerability is limited to systems running unpatched versions (11.9.0.12 and earlier, or 12.0.0.5 and earlier). Default deployments are likely vulnerable unless explicitly patched; non-default configurations with additional access controls (e.g., external authentication + attribute-based access control) may reduce practical risk but do not prevent the underlying authorization bypass in the metrics subsystem.

CVSS 2.3 with CVSS:4.0 vector indicates low severity: network-accessible (AV:N) but requires low-privilege authentication (PR:L), low complexity (AC:L), and attack timing conditions (AT:P). Confidentiality impact is limited (VC:L) with no integrity or availability risk (VI:N/VA:N). The real-world risk is moderate in environments where StorageGRID handles sensitive data and multiple users or applications share the same grid with role-based access controls; a low-privileged user breaching metric compartmentalization could expose operational telemetry, performance data, or indirect information about other tenants' storage patterns. The attack timing requirement (AT:P) suggests the exploit depends on specific transient conditions, reducing exploitability likelihood compared to unconditional attacks. No EPSS score provided in input, but KEV/active exploitation status not indicated-suggesting disclosure risk is recognized but not yet targeted in coordinated campaigns. The patch availability is the primary mitigating factor; organizations on older 11.x or 12.0.0 versions face direct exposure.

An authenticated user with low-privilege credentials (e.g., a limited-access tenant account or junior administrator) submits a crafted metrics query request to the StorageGRID Admin Node or API endpoint. Due to insufficient authorization validation, the query is executed and returns metrics data-such as detailed I/O patterns, storage utilization by other tenants, or performance baseline data-that the attacker's privilege level should not permit access to. If timing conditions align (AT:P requirement), the attacker retrieves sensitive operational information that could inform further attacks or data exfiltration strategies.