CVE-2026-73265

MediumCVSS 6.5/10Last modified Sep 9, 2026

Description

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content. This issue is fixed in version 1.0.0-beta.11.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Aug 12, 2026
Last modified: Sep 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-732667.1A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerabil CVE-2026-732677.7A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and de CVE-2026-732689.9A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on Clu CVE-2026-732699.9A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming con CVE-2026-73278.1An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 1 CVE-2026-732708.2Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside CVE-2026-732734.3Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated CVE-2026-732768.3Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP CVE-2026-732789.8Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second fa CVE-2026-73286.8Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsy CVE-2026-732813.5In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that a CVE-2026-732824.8In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.