CVE-2026-70463

Name of the Vulnerable Software and Affected Versions rsync versions 3.1.0 through 3.4.x

Description An authorization bypass exists in the parsing of the auth users directive. The parser utilizes comma-only tokenization when splitting the user list, which fails to correctly process entries formatted as @Group Name when the group name contains a space. This causes the parser to split the entry at the space boundary, resulting in the silent discard of the associated deny rule. Consequently, an authenticated user who should be denied access based on their username or group membership can connect to a restricted module.

Recommendations Update to version 3.5.0 or later.