A critical authorization flaw in SeaweedFS allows authenticated federated users to bypass IAM role trust policies and gain unauthorized access to restricted S3 storage resources.

This vulnerability is an incorrect authorization issue (CWE-863) where the S3 API incorrectly validates OIDC JWT tokens by bypassing standard STS AssumeRoleWithWebIdentity trust checks. An authenticated user can leverage a valid token to assume roles they are not permitted to hold, granting them unauthorized read, write, and delete access to S3 objects.

The ability for a low-privileged federated user to escalate privileges and access unauthorized data poses a severe risk to data confidentiality and integrity. Given the CVSS score of 8.7, this vulnerability is categorized as High severity, as it facilitates unauthorized access to sensitive file and blob storage systems. Successful exploitation could lead to significant data exfiltration or destructive modification of business-critical assets.

Immediate Action: Upgrade SeaweedFS to version 4.40 or later to ensure proper enforcement of IAM role trust policies during OIDC token validation.

Proactive Monitoring: Review S3 API access logs for anomalous AssumeRole patterns or unexpected cross-role access attempts originating from federated OIDC users.

Compensating Controls: Implement strict network-level segmentation or IP whitelisting for the S3 API endpoint to limit the exposure of the storage system to known, trusted networks while the upgrade is pending.

Public Exploit Available: No

The severity of this authorization bypass necessitates immediate attention from security teams managing SeaweedFS deployments. Organizations should prioritize patching to version 4.40 immediately to prevent potential privilege escalation and unauthorized data access. If an immediate upgrade is not feasible, restrict access to the affected S3 API endpoints to minimize the attack surface.