The RADOS Gateway (RGW) uses an AES-128-CBC handler to protect STS session tokens that lacks message authentication. This allows an attacker with a valid STS token to perform a CBC bit-flip on the `acct type`, `perm type`, and `is admin` fields. By forging the `is admin` value, an attacker can trigger a global administrative override to bypass all capability checks and gain full RGW administrative access. This issue is reachable remotely via the RGW S3 endpoint and requires only a single valid STS token with STS enabled.