rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories (CVE-2026-59733)
Rclone versions prior to 1.74.4 have an authorization bypass vulnerability in the 'serve restic --private-repos' command. This flaw allows an authenticated user to use '..' in the URL path to access, modify, or delete other users' private repositories. The issue arises because the backend object key is built from the raw uncleaned URL path, while authorization is enforced on the routed user path segment. This vulnerability is fixed in version 1.74.4.
AI Analysis
Technical Summary
Rclone before version 1.74.4 contains an authorization bypass vulnerability in the 'serve restic --private-repos' feature. The backend object key construction uses the raw URL path without cleaning path components, enabling an authenticated user to include '..' sequences in requests (e.g., //..//config) to escape their authorized repository path. This allows reading, overwriting, or deleting other users' private repositories on backends that normalize path components. The vulnerability is resolved in rclone 1.74.4 by properly handling and sanitizing URL paths to enforce authorization correctly.
Potential Impact
An authenticated user can bypass intended authorization restrictions and access, modify, or delete private repositories belonging to other users. This compromises data confidentiality, integrity, and availability for affected rclone deployments using the vulnerable 'serve restic --private-repos' feature.
Mitigation Recommendations
Upgrade rclone to version 1.74.4 or later, where this vulnerability is fixed. The vendor has provided official patches and the issue is resolved in the stated version. No additional mitigation is required once the upgrade is applied.
rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories (CVE-2026-59733)
Description
Rclone versions prior to 1.74.4 have an authorization bypass vulnerability in the 'serve restic --private-repos' command. This flaw allows an authenticated user to use '..' in the URL path to access, modify, or delete other users' private repositories. The issue arises because the backend object key is built from the raw uncleaned URL path, while authorization is enforced on the routed user path segment. This vulnerability is fixed in version 1.74.4.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Rclone before version 1.74.4 contains an authorization bypass vulnerability in the 'serve restic --private-repos' feature. The backend object key construction uses the raw URL path without cleaning path components, enabling an authenticated user to include '..' sequences in requests (e.g., //..//config) to escape their authorized repository path. This allows reading, overwriting, or deleting other users' private repositories on backends that normalize path components. The vulnerability is resolved in rclone 1.74.4 by properly handling and sanitizing URL paths to enforce authorization correctly.
Potential Impact
An authenticated user can bypass intended authorization restrictions and access, modify, or delete private repositories belonging to other users. This compromises data confidentiality, integrity, and availability for affected rclone deployments using the vulnerable 'serve restic --private-repos' feature.
Mitigation Recommendations
Upgrade rclone to version 1.74.4 or later, where this vulnerability is fixed. The vendor has provided official patches and the issue is resolved in the stated version. No additional mitigation is required once the upgrade is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-rclone-2026-59733
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-59733"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- Cvss Version
- null
Patch Information
Threat ID: 6aa005c7acd9273b49ab5c70
Added to database: 09/08/2026, 12:55:35 UTC
Last enriched: 09/08/2026, 13:20:39 UTC
Last updated: 09/08/2026, 22:52:13 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.