CVE-2026-72921

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.24

Description In the distributed storage system, the authorization check for allowed prefixes within weed/server/filer server handlers.go uses strings.HasPrefix on raw path strings. This implementation allows a JSON Web Token (JWT) scoped to a specific path, such as /tenant1, to inadvertently authorize access to sibling paths like /tenant1234, /tenant1-old, and /tenant1backup. This flaw enables unauthorized cross-tenant read and write operations when using a valid scoped token.

Recommendations Update to version 4.24.