CVE-2026-73265 PUBLISHED

RustFS: Version-specific object reads authorize the non-version action

Assigner: GitHub_M
Reserved: 11.08.2026 Published: 12.08.2026 Updated: 12.08.2026

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content. This issue is fixed in version 1.0.0-beta.11.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	rustfs
Product	rustfs
Versions	Version < 1.0.0-beta.11 is affected

References

https://github.com/rustfs/rustfs/security/advisories/GHSA-3ppv-fx5m-m749
https://github.com/rustfs/rustfs/pull/5142
https://github.com/rustfs/rustfs/commit/81665617029e5e437ecf9dc70d8dcbbbf80cdbd1
https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.11

Problem Types

CWE-862: Missing Authorization CWE
CWE-863: Incorrect Authorization CWE