CVE-2026-73265

MEDIUM 6.5

RustFS: Version-specific object reads authorize the non-version action

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content. This issue is fixed in version 1.0.0-beta.11.

CWE	CWE-862 CWE-863
Vendor	rustfs
Product	rustfs
Published	Aug 12, 2026

Stay Ahead of the Next One

Get instant alerts for rustfs rustfs

Be the first to know when new medium vulnerabilities affecting rustfs rustfs are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

rustfs / rustfs

< 1.0.0-beta.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rustfs/rustfs/security/advisories/GHSA-3ppv-fx5m-m749 github.com: https://github.com/rustfs/rustfs/pull/5142 github.com: https://github.com/rustfs/rustfs/commit/81665617029e5e437ecf9dc70d8dcbbbf80cdbd1 github.com: https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.11