CVE-2026-72921

HighCVSS 8.1/10Last modified Sep 9, 2026

Description

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Sep 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-729228.2AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, CVE-2026-729237.5The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON a CVE-2026-729242.1GitHub CLI (gh) is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports CVE-2026-729256.1SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the m CVE-2026-729267.0Use after free in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.CVE-2026-729277.8Heap-based buffer overflow in Winsock allows an authorized attacker to elevate privileges locally.CVE-2026-729287.5Use after free in Windows DNS allows an authorized attacker to execute code over a network.CVE-2026-729297.8Improper validation of integrity check value in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-72934.7A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function delete_category of the file /admin/aja CVE-2026-729307.0Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to execute code locally.CVE-2026-729315.5Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to den CVE-2026-729327.5Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.