CVE-2026-70463 is an authorization bypass vulnerability in RsyncProject's rsync software versions 3.1.0 up to and including 3.4.4. The issue arises from the auth users directive parser, which splits user lists only by commas and does not properly handle entries of the form '@Group Name' when the group name contains spaces. The space causes the parser to split the entry incorrectly, discarding the deny rule associated with that group. Consequently, authenticated users who should be denied access based on group membership can bypass restrictions and connect to restricted modules.

Authenticated users who would normally be denied access due to group membership restrictions can bypass these controls and gain unauthorized access to restricted rsync modules. This could lead to unauthorized data access or modification depending on the module's permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid using group names with spaces in auth users directives or implement additional access controls outside of rsync to mitigate unauthorized access.