An authorization vulnerability in SeaweedFS versions 3.88 through 4.39 permits authenticated users to bypass path-based access controls and potentially access unauthorized files.

The SFTP server implementation performs an insecure string-prefix comparison when validating path permissions, failing to enforce path-component boundaries. This allows an authenticated low-privilege user to gain read or write access to directories outside their assigned scope by referencing sibling paths that share the same prefix.

Successful exploitation of this vulnerability results in a significant breach of data confidentiality and integrity. Because the flaw allows an authenticated user to access sensitive data belonging to other tenants, organizations face risks of unauthorized information disclosure and potential data manipulation. The CVSS score of 8.1 reflects the high severity of this access control failure, as it allows lateral movement within the file system without requiring administrative privileges.

Immediate Action: Upgrade the SeaweedFS installation to version 4.40 or later to implement the corrected path authorization logic.

Proactive Monitoring: Review SFTP access logs for patterns indicating unauthorized directory traversal attempts, such as requests for paths that do not belong to the authenticated user's assigned scope.

Compensating Controls: If an immediate upgrade is not feasible, restrict the SFTP service access to trusted internal networks and implement strict file system level permissions (OS-level ACLs) that apply independently of the application-layer configuration.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for cross-tenant data access, this vulnerability poses a high risk to multi-tenant environments. Administrators should prioritize the deployment of version 4.40 to ensure proper authorization boundaries are enforced. Failure to address this flaw could lead to severe data compromise, making immediate patching the only recommended course of action.