Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/05/05 8:14 p.m.29 views

RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover

Summary ListServiceAccount GET /rustfs/admin/v3/list-service-accounts?user= authorizes cross-user requests against UpdateServiceAccountAdminAction instead of ListServiceAccountsAdminAction at rustfs/src/admin/handlers/serviceaccount.rs:936. The handler accepts the wrong admin action and rejects t...

5.8AI score
SaveExploits0References2Affected Software1
Rows per page
Query Builder