Rucio Has An Authorization Bypass On REST API Endpoint For Signing URLs

Summary The "/credentials/signurl" endpoint decides authorization from the client-supplied "X-Rucio-Account" HTTP header instead of the authenticated token's account. Any client holding any valid auth token even a low-privilege account they legitimately own can send "X-Rucio-Account: root" to pas...