Threats Tagged 'bit-seaweedfs-2026-55873'

SeaweedFS versions from 4.08 up to but not including 4.34 contain an authorization flaw in the S3Tables and Iceberg REST management API. This flaw allows a low-privileged authenticated S3 user with only ordinary read permissions to enumerate administrator-owned table buckets, revealing bucket names and ARNs. The vulnerability arises because authorization collapsed account-less S3 identities into a shared admin account and defaulted to allow access. The issue was fixed in version 4.34 by changing the authorization logic to require an explicit ACTION_ADMIN capability and removing the insecure default allow behavior. No configuration workaround exists; upgrading to 4.34 or later is required.