RustFS contains a critical authorization vulnerability in its ListServiceAccount handler, which incorrectly authorizes requests using the UpdateServiceAccount permission instead of the intended ListServiceAccounts permission. This allows users with only update privileges to enumerate all service accounts, including the root user's, exposing sensitive access keys. Additionally, the UpdateServiceAccount handler lacks ownership verification, enabling any user with update permission to overwrite any service account's secret. Chaining these issues allows an attacker to take full administrative control of RustFS by enumerating root access keys and replacing them to create persistent backdoor admin accounts. The vulnerability affects versions from the initial introduction of service account checks through 1.0.0-alpha.97 and is fixed in 1.0.0-alpha.98.