SeaweedFS bug lets one tenant read another's files

Published September 2, 2026 CVE-2026-72921

SeaweedFS is a storage system companies use to hold huge numbers of files for many customers or teams at once. A bug in how it checks access tokens let someone with a token for their own folder also read and write files in a similarly named folder that belongs to someone else.

Severity
HighCVSS 3.1 · 8.1
Fix
Fixed in 0.0.0-20260512171048-05ed5c9ae8a2Fix recorded on Sep 2, 2026
Affected versions
before 0.0.0-20260512171048-05ed5c9ae8a2
Weakness
CWE-863Incorrect Authorization
Exploit likelihood
0.24% in 30 daysEPSS, higher than 15% of known flaws
Affects
SeaweedFS

How it works

SeaweedFS checked a file access token's allowed folder by matching the start of the file path as plain text instead of matching whole folder names, so a token scoped to a folder like tenant1 also worked on lookalike folders such as tenant1234 or tenant1-old.

What to do

Check the SeaweedFS version your filer is running and see if any allowed_prefixes folder names could be a text prefix of another folder's name, such as tenant1 and tenant1backup.

Upgrade SeaweedFS to version 4.24 or later, where the prefix check was fixed to match full folder names instead of raw text. Until then, avoid prefix names that are substrings of each other, for example by always including a trailing slash in the scoped path.

Technical details

The flaw is in weed/server/filer_server_handlers.go, where the allowed_prefixes authorization check used Go's strings. HasPrefix on raw path strings rather than comparing normalized, slash-separated path components. A JWT scoped to /tenant1 therefore also passed the check for /tenant1234, /tenant1-old, and /tenant1backup.

Because allowed_prefixes gates both read and write tokens, a valid scoped token from one tenant could be used for cross-tenant reads and writes. Version 4.24 fixes this by applying path. Clean and matching on full path components, so a scope only authorizes its own path and descendants.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source