CVE-2023-25812

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-281

Affected software

Vendor	Product	Versions
minio	minio	>= RELEASE.2020-04-10T03-34-42Z, < RELEASE.2023-02-17T17-52-43Z

References

https://github.com/minio/minio/commit/a7188bc9d0f0a5ae05aaf1b8126bcd3cb3fdc485Patch
https://github.com/minio/minio/pull/16635Issue Tracking, Patch
https://github.com/minio/minio/security/advisories/GHSA-c8fc-mjj8-fc63Exploit, Vendor Advisory
https://github.com/minio/minio/commit/a7188bc9d0f0a5ae05aaf1b8126bcd3cb3fdc485Patch
https://github.com/minio/minio/pull/16635Issue Tracking, Patch
https://github.com/minio/minio/security/advisories/GHSA-c8fc-mjj8-fc63Exploit, Vendor Advisory

Timeline

Published: Feb 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-258139.8Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are pa CVE-2023-258146.5metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file th CVE-2023-258152.2In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to CVE-2023-258166.5Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consump CVE-2023-258178.1Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their per CVE-2023-258187.1Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of CVE-2023-258195.3Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site CVE-2023-25826.1A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applicatio CVE-2023-258207.8Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the ente CVE-2023-258217.5Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, conta CVE-2023-258226.5ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the `com.epam.reportportal:service-api` module, correspon CVE-2023-258239.8Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 cont