CVE-2026-72921
Received Received - Intake

Authorization Bypass in SeaweedFS via Path Prefix Matching

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72921
EUVD
EUVD-2026-56159

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
seaweedfs seaweedfs 4.24

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72921 is an authorization bypass vulnerability in SeaweedFS's Filer JWT system. It occurs because the allowed_prefixes check used raw byte-prefix matching, allowing a token scoped to /tenant1 to also access sibling paths like /tenant1234, /tenant1-old, or /tenant1backup. This enables cross-tenant reads and writes in multi-tenant deployments.

Detection Guidance

To detect this vulnerability, check if your SeaweedFS version is below 4.24. Run: weed version. If the output shows a version older than 4.24, the system is vulnerable. Additionally, review JWT token scopes in filer configurations to identify any misconfigured allowed_prefixes that could allow unauthorized access.

Impact Analysis

This vulnerability allows unauthorized users with a valid scoped JWT token to access data in sibling directories they should not have permission to access. This could lead to data breaches, unauthorized modifications, or data leaks in multi-tenant environments.

Compliance Impact

This vulnerability could violate compliance requirements for data isolation and access controls. GDPR requires strict data segregation and access limits, while HIPAA mandates safeguards to prevent unauthorized access to protected health information. The flaw undermines these requirements by enabling unauthorized cross-tenant data access.

Mitigation Strategies

Upgrade SeaweedFS to version 4.24 or later immediately. If upgrading is not possible, avoid using prefix names that are string prefixes of each other in JWT allowed_prefixes configurations to prevent cross-tenant access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72921. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart