CVE-2026-73265
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In RustFS, explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources are authorized with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content.
Risk Assessment
Risk of disclosing historical data that should be protected. This could compromise confidentiality and access control policies for object versions.
Recommendation
Update RustFS to version 1.0.0-beta.11 or later, which includes the fix. Ensure that authorization uses the appropriate actions for versions.
Original NVD description (English source)
RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content. This issue is fixed in version 1.0.0-beta.11.