{"id":"CVE-2026-55873","aliases":["GHSA-hgpf-8634-g44c"],"title":"SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets","summary":"SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets","severity":"medium","cvss":4.3,"cwe":["CWE-863"],"vendor":"seaweedfs","product":"github.com/seaweedfs/seaweedfs","ecosystem":"go","affected":["github.com/seaweedfs/seaweedfs >= 0.0.0-20260128085517-09bb90e8dc16, < 0.0.0-20260614205536-b13463880c1f"],"patched":["github.com/seaweedfs/seaweedfs 0.0.0-20260614205536-b13463880c1f"],"published":"2026-08-28","updated":"2026-08-28","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-hgpf-8634-g44c","references":[{"url":"https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-hgpf-8634-g44c"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55873"},{"url":"https://github.com/seaweedfs/seaweedfs/pull/9961"},{"url":"https://github.com/seaweedfs/seaweedfs/commit/b13463880c1fa62e255c058a9228b63cc95b4b36"},{"url":"https://github.com/seaweedfs/seaweedfs/releases/tag/4.34"},{"url":"https://github.com/advisories/GHSA-hgpf-8634-g44c"}],"tags":["ghsa","go"],"epss":0.00342,"epssPercentile":0.27739,"ingestedAt":"2026-08-28T22:26:18.998Z","slug":"CVE-2026-55873","body":"## Overview\n\n### Summary\nSeaweedFS routes requests signed with SigV4 service `s3tables` to the S3Tables\nmanagement API. Authorization on that path collapsed account-less S3 identities\ninto the shared `admin` account and failed open, so a user holding only ordinary\nS3 `Read` credentials — and no S3Tables-specific permission — could invoke\nS3Tables management operations such as `GET /buckets` and enumerate\nadministrator-owned table bucket inventory (names and ARNs). The same handler\nbacks the Iceberg REST catalog, which was affected by the same flaw.\n\n### Impact\nAn authenticated low-privileged S3 user can cross the boundary between ordinary\nS3 object access and S3Tables management. Confirmed impact is disclosure of\nadministrator-owned table bucket inventory (bucket names and ARNs); in shared or\nmulti-tenant deployments this can reveal tenant naming and operational structure.\n\n### Affected versions\nSeaweedFS `>= 4.08, < 4.34` (the S3Tables management API was introduced in 4.08).\n\n### Patched versions\nFixed in **4.34** (#9961). Administrator status is now decided by the\n`ACTION_ADMIN` capability rather than by a collapsed `admin` account id, S3Tables\nauthorization no longer defaults to allow, and the tautological ListTableBuckets\ngate was removed. Related hardening of the same root cause landed in #9962,\n#9963, and #9971.\n\n### Workaround\nNo configuration workaround — upgrade to 4.34 or later.\n\n### Credit\nReported by **TA-MU-TA**.\n\n## Affected packages\n\n- `github.com/seaweedfs/seaweedfs >= 0.0.0-20260128085517-09bb90e8dc16, < 0.0.0-20260614205536-b13463880c1f`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/seaweedfs/seaweedfs 0.0.0-20260614205536-b13463880c1f`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}