CVE-2026-70463: CWE-863 Incorrect Authorization in RsyncProject rsync
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.
AI Analysis
Technical Summary
CVE-2026-70463 is an authorization bypass vulnerability in RsyncProject's rsync software affecting versions 3.1.0 up to and including 3.4.4. The issue arises from the auth users directive parser using comma-only tokenization, which mishandles entries of the form '@Group Name' when the group name contains spaces. The space causes the parser to split the entry incorrectly, discarding the deny rule for that group. Consequently, authenticated users who should be denied access based on their username or group membership can bypass restrictions and connect to restricted modules.
Potential Impact
This vulnerability allows authenticated users who would normally be denied access due to their username or group membership to bypass authorization controls and access restricted modules. This could lead to unauthorized access to sensitive data or functionality within rsync modules.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should carefully review and avoid using auth users entries with group names containing spaces or apply alternative access control measures to mitigate the risk.
CVE-2026-70463: CWE-863 Incorrect Authorization in RsyncProject rsync
Description
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.
CVSS v4.0
Score 8.6high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-70463 is an authorization bypass vulnerability in RsyncProject's rsync software affecting versions 3.1.0 up to and including 3.4.4. The issue arises from the auth users directive parser using comma-only tokenization, which mishandles entries of the form '@Group Name' when the group name contains spaces. The space causes the parser to split the entry incorrectly, discarding the deny rule for that group. Consequently, authenticated users who should be denied access based on their username or group membership can bypass restrictions and connect to restricted modules.
Potential Impact
This vulnerability allows authenticated users who would normally be denied access due to their username or group membership to bypass authorization controls and access restricted modules. This could lead to unauthorized access to sensitive data or functionality within rsync modules.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should carefully review and avoid using auth users entries with group names containing spaces or apply alternative access control measures to mitigate the risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-04T14:52:23.815Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7ddecabf8831d5395d0084
Added to database: 08/13/2026, 15:12:10 UTC
Last enriched: 08/13/2026, 15:26:40 UTC
Last updated: 08/13/2026, 20:08:38 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.