CVE-2026-72921CWE-863broken-access-control

CVE-2026-72921

High · published August 11, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
35.8
In the wild
Unconfirmed
What it is

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00426 · 35.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-11T19:17Z
References (4)
https://github.com/seaweedfs/seaweedfs/commit/05ed5c9ae8a2a45101b52b61d02f170d20d587ff · [email protected]https://github.com/seaweedfs/seaweedfs/pull/9439 · [email protected]https://github.com/seaweedfs/seaweedfs/releases/tag/4.24 · [email protected]https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-gv5w-hfx8-8cwq · [email protected]
EPSS history
Timeline
  • 11 AUG 14:28Z
    SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
    cvelistv5