CVE-2026-77611

Received Received - Intake

Authenticated S3 ACL Bypass in SeaweedFS

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope by calling PutObjectAcl on the key it is allowed to access. The handler authorizes the request against the requested nested key but then writes the updated entry back to the bucket root rather than the key's actual parent directory, so an ACL change on allowed/protected.txt is instead applied to protected.txt at the bucket root. Because the update carries the full entry rather than only ACL metadata, an existing target object is overwritten with the content, metadata, owner information, and ACL of the scoped object, bypassing the object-level action scoping configured through the static S3 identity file. This issue is fixed in version 4.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-77611

Affected Vendors & Products

Vendor	Product	Version / Range
seaweedfs	seaweedfs	to 4.40 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects SeaweedFS, a distributed storage system, in versions before 4.40. An authenticated S3 user with limited permissions can overwrite a different object outside their scope by using PutObjectAcl on a nested key they can access. The system incorrectly applies the ACL change to the bucket root instead of the key's parent directory, causing the target object to be overwritten with the scoped object's content, metadata, owner info, and ACL.

Detection Guidance

This vulnerability requires authenticated access and specific S3 permissions. To detect it, review SeaweedFS logs for unauthorized PutObjectAcl operations or ACL changes on objects outside the expected scope. Check for unexpected overwrites of files in the bucket root. No specific commands are provided in the context.

Impact Analysis

An attacker with limited S3 access could overwrite critical files, such as configuration files or sensitive data, by exploiting this flaw. This could lead to data corruption, unauthorized access to other users' data, or disruption of services relying on SeaweedFS for storage.

Compliance Impact

This vulnerability could lead to unauthorized data modification or access, violating integrity and confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable SeaweedFS versions may fail compliance audits due to insufficient access controls and data protection measures.

Mitigation Strategies

Upgrade SeaweedFS to version 4.40 or later to address the vulnerability. Ensure all S3 principals have the least privileges required for their roles to prevent unauthorized ACL modifications.

Hi! I’m here to help you understand CVE-2026-77611. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70