GHSA-gv5w-hfx8-8cwq

Source

https://github.com/advisories/GHSA-gv5w-hfx8-8cwq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gv5w-hfx8-8cwq/GHSA-gv5w-hfx8-8cwq.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-gv5w-hfx8-8cwq

Aliases

Downstream

MINI-47cq-q2wm-xq4m

MINI-fmfq-w4w4-jp9c

Published

2026-09-02T23:42:05Z

Modified

2026-09-03T00:30:05Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

Details

Impact

When a filer JWT restricts a token to a set of path prefixes via allowed_prefixes, the authorization check used a literal byte-prefix match (strings.HasPrefix). A token scoped to /tenant1 therefore also authorized requests to sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup.

In a multi-tenant deployment this lets the holder of one tenant's token access another tenant's data. Because allowed_prefixes gates both read and write tokens, the impact covers cross-tenant reads and writes. A valid scoped token is required, so this is an authorization bypass rather than a fully unauthenticated flaw.

Affected component

weed/server/filer_server_handlers.go (JWT allowed_prefixes authorization check)

Patches

Fixed in 4.24. The check now matches on /-separated path components after path.Clean normalisation, so /tenant1 authorizes only /tenant1 and its descendants — not /tenant1234 or other sibling paths.

Workarounds

Where feasible, choose prefix names that are not string-prefixes of one another (e.g. keep a trailing separator convention). Upgrade to 4.24.

References

Reported by Kadir Arslan (https://github.com/KadirArslan)

Database specific

{
    "cwe_ids": [
        "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T23:42:05Z",
    "nvd_published_at": "2026-08-11T15:17:38Z",
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/seaweedfs/seaweedfs

Package

Name: github.com/seaweedfs/seaweedfs; View open source insights on deps.dev
Purl: pkg:golang/github.com/seaweedfs/seaweedfs

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20260512171048-05ed5c9ae8a2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gv5w-hfx8-8cwq/GHSA-gv5w-hfx8-8cwq.json"