CVE-2026-72921
SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.
| CWE | CWE-863 |
| Vendor | seaweedfs |
| Product | seaweedfs |
| Published | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for seaweedfs seaweedfs
Be the first to know when new high vulnerabilities affecting seaweedfs seaweedfs are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
seaweedfs / seaweedfs
< 4.24
References
github.com: https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-gv5w-hfx8-8cwq github.com: https://github.com/seaweedfs/seaweedfs/pull/9439 github.com: https://github.com/seaweedfs/seaweedfs/commit/05ed5c9ae8a2a45101b52b61d02f170d20d587ff github.com: https://github.com/seaweedfs/seaweedfs/releases/tag/4.24