{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77368",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T13:53:15.860274Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T14:32:40.158Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "seaweedfs",
          "vendor": "seaweedfs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.39, \u003c 4.40"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer\u0027s TUS resumable-upload handler checks JWT allowed_prefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant\u0027s upload session to write content to filer paths their own token forbids. The HEAD, PATCH, and DELETE verbs that act on an existing session by its id never verify that the session\u0027s stored target path falls within the caller\u0027s allowed prefixes, so a tenant who obtains another upload\u0027s session identifier can PATCH attacker bytes into it and, on completion, have the file land at the victim\u0027s out-of-scope path. The same token can also DELETE other tenants\u0027 sessions and HEAD them to read upload progress and size, defeating the JWT prefix isolation. This vulnerability only affects deployments that configure filer JWT signing and have TUS uploads enabled. This issue is fixed in version 4.40."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T21:07:57.105Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-99q7-x53r-6j4g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-99q7-x53r-6j4g"
        },
        {
          "name": "https://github.com/seaweedfs/seaweedfs/commit/ce82e3a057080162a9fba11889157d2255815f71",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/seaweedfs/seaweedfs/commit/ce82e3a057080162a9fba11889157d2255815f71"
        },
        {
          "name": "https://github.com/seaweedfs/seaweedfs/commit/fa549e9c83b7799d512157d728f52052912831af",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/seaweedfs/seaweedfs/commit/fa549e9c83b7799d512157d728f52052912831af"
        }
      ],
      "source": {
        "advisory": "GHSA-99q7-x53r-6j4g",
        "discovery": "UNKNOWN"
      },
      "title": "SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77368",
    "datePublished": "2026-08-26T21:07:57.105Z",
    "dateReserved": "2026-08-20T19:36:13.804Z",
    "dateUpdated": "2026-08-27T14:32:40.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths\", \"source\": {\"advisory\": \"GHSA-99q7-x53r-6j4g\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"seaweedfs\", \"product\": \"seaweedfs\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.39, \u003c 4.40\"}]}], \"references\": [{\"url\": \"https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-99q7-x53r-6j4g\", \"name\": \"https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-99q7-x53r-6j4g\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/seaweedfs/seaweedfs/commit/ce82e3a057080162a9fba11889157d2255815f71\", \"name\": \"https://github.com/seaweedfs/seaweedfs/commit/ce82e3a057080162a9fba11889157d2255815f71\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/seaweedfs/seaweedfs/commit/fa549e9c83b7799d512157d728f52052912831af\", \"name\": \"https://github.com/seaweedfs/seaweedfs/commit/fa549e9c83b7799d512157d728f52052912831af\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer\u0027s TUS resumable-upload handler checks JWT allowed_prefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant\u0027s upload session to write content to filer paths their own token forbids. The HEAD, PATCH, and DELETE verbs that act on an existing session by its id never verify that the session\u0027s stored target path falls within the caller\u0027s allowed prefixes, so a tenant who obtains another upload\u0027s session identifier can PATCH attacker bytes into it and, on completion, have the file land at the victim\u0027s out-of-scope path. The same token can also DELETE other tenants\u0027 sessions and HEAD them to read upload progress and size, defeating the JWT prefix isolation. This vulnerability only affects deployments that configure filer JWT signing and have TUS uploads enabled. This issue is fixed in version 4.40.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-26T21:07:57.105Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-77368\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-27T13:53:15.860274Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-08-27T13:53:16.854Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-77368\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-26T21:07:57.105Z\", \"dateReserved\": \"2026-08-20T19:36:13.804Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-26T21:07:57.105Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}