A high-severity privilege escalation flaw in MinIO allows authenticated users with restricted permissions to elevate their access to full parent privileges, posing a significant risk to data integrity and confidentiality.

The vulnerability, categorized as CWE-863 (Incorrect Authorization), stems from flawed IAM policy validation logic where the system incorrectly relies on DenyOnly arguments for session policies. An authenticated attacker with restricted service account or STS credentials can exploit this to create new service accounts that lack the intended parent policy restrictions.

This vulnerability enables unauthorized access to sensitive buckets and objects that should be protected by restricted session policies. Given the CVSS score of 8.1, the potential for an attacker to modify, delete, or exfiltrate data outside their authorized scope represents a severe risk to organizational data security and compliance posture.

Immediate Action: Update MinIO to release version RELEASE.2025-10-15T17-29-55Z or newer immediately to apply the corrected IAM policy validation logic.

Proactive Monitoring: Monitor MinIO audit logs for suspicious activity, specifically focusing on the creation of new service accounts by existing restricted service or STS accounts.

Compensating Controls: While no direct WAF rule can fix this logic flaw, organizations should enforce strict identity and access management controls and limit the creation of new service accounts to authorized administrative roles only.

Public Exploit Available: Yes — a public proof-of-concept exists via a GitHub repository.

The ability for a restricted user to escalate privileges to full parent status is a critical failure in the authorization model of the MinIO object storage system. Security teams should prioritize patching this vulnerability across all production environments immediately. Failure to update will leave the storage infrastructure vulnerable to unauthorized data manipulation and potential exfiltration by compromised or malicious service accounts.