A missing authorization vulnerability in RustFS allows low-privileged users to perform administrative actions, posing a significant risk to data integrity and audit logs.

The vulnerability exists in the rustfs/src/admin/handlers/event.rs file, where notification target API endpoints fail to perform proper admin-action authorization. While the system validates the session token (authentication), it fails to verify if the user has administrative privileges (authorization), allowing any authenticated user to modify system-wide notification settings.

Successful exploitation allows an attacker to redirect bucket events to an arbitrary, attacker-controlled endpoint. This results in unauthorized cross-user event interception and allows for deliberate audit evasion, which undermines the security posture of the distributed storage environment. Given the CVSS score of 8.3, this flaw represents a high-severity risk to confidentiality and integrity within the infrastructure.

Immediate Action: Update the RustFS deployment to version 1.0.0-alpha.94 or later to ensure proper authorization checks are enforced on all admin handlers.

Proactive Monitoring: Review audit logs for unexpected modifications to notification targets or anomalous event delivery configurations that deviate from established administrative baselines.

Compensating Controls: Implement strict network-level access controls to restrict access to the administrative API endpoints to only trusted management subnets or specific IP addresses.

Public Exploit Available: Unknown

The vulnerability is highly critical due to the potential for complete audit evasion and event interception within the storage system. Organizations currently running versions of RustFS prior to 1.0.0-alpha.94 should prioritize the deployment of the patched version immediately to prevent unauthorized modification of critical system settings.