CVE-2026-40937

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in "rustfs/src/admin/handlers/event.rs" use a "checkpermissions" helper that validates authentication only access key + session token, without performing any...

CVE-2026-40937: Missing Authorization

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in rustfs/src/admin/handlers/event.rs use a checkpermissions helper that validates authentication only access key + session token, without performing any...