CVE-2026-40937 RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in rustfs/src/admin/handlers/event.rs use a checkpermissions helper that validates authentication only access key + session token, without performing any...

CVE-2026-40937

Summary: RustFS prior to 1.0.0-alpha.94 exposes a critical admin-authorization flaw in the notification target endpoints. The four endpoints in rustfs/src/admin/handlers/event.rs call a check_permissions (auth only) instead of validate_admin_request with a specific AdminAction, unlike other admin...