{"id":"GHSA-hgpf-8634-g44c","summary":"SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets","details":"### Summary\nSeaweedFS routes requests signed with SigV4 service `s3tables` to the S3Tables\nmanagement API. Authorization on that path collapsed account-less S3 identities\ninto the shared `admin` account and failed open, so a user holding only ordinary\nS3 `Read` credentials — and no S3Tables-specific permission — could invoke\nS3Tables management operations such as `GET /buckets` and enumerate\nadministrator-owned table bucket inventory (names and ARNs). The same handler\nbacks the Iceberg REST catalog, which was affected by the same flaw.\n\n### Impact\nAn authenticated low-privileged S3 user can cross the boundary between ordinary\nS3 object access and S3Tables management. Confirmed impact is disclosure of\nadministrator-owned table bucket inventory (bucket names and ARNs); in shared or\nmulti-tenant deployments this can reveal tenant naming and operational structure.\n\n### Affected versions\nSeaweedFS `\u003e= 4.08, \u003c 4.34` (the S3Tables management API was introduced in 4.08).\n\n### Patched versions\nFixed in **4.34** (#9961). Administrator status is now decided by the\n`ACTION_ADMIN` capability rather than by a collapsed `admin` account id, S3Tables\nauthorization no longer defaults to allow, and the tautological ListTableBuckets\ngate was removed. Related hardening of the same root cause landed in #9962,\n#9963, and #9971.\n\n### Workaround\nNo configuration workaround — upgrade to 4.34 or later.\n\n### Credit\nReported by **TA-MU-TA**.","aliases":["BIT-seaweedfs-2026-55873","CVE-2026-55873","GO-2026-6329"],"modified":"2026-09-02T19:56:01.622890232Z","published":"2026-08-28T22:16:43Z","database_specific":{"cwe_ids":["CWE-863"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-08-28T22:16:43Z","nvd_published_at":"2026-07-08T15:16:30Z"},"references":[{"type":"WEB","url":"https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-hgpf-8634-g44c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55873"},{"type":"WEB","url":"https://github.com/seaweedfs/seaweedfs/pull/9961"},{"type":"WEB","url":"https://github.com/seaweedfs/seaweedfs/commit/b13463880c1fa62e255c058a9228b63cc95b4b36"},{"type":"PACKAGE","url":"https://github.com/seaweedfs/seaweedfs"},{"type":"WEB","url":"https://github.com/seaweedfs/seaweedfs/releases/tag/4.34"}],"affected":[{"package":{"name":"github.com/seaweedfs/seaweedfs","ecosystem":"Go","purl":"pkg:golang/github.com/seaweedfs/seaweedfs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-20260128085517-09bb90e8dc16"},{"fixed":"0.0.0-20260614205536-b13463880c1f"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-hgpf-8634-g44c/GHSA-hgpf-8634-g44c.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}