Samba’s vfs_ceph_rgw module contains a flaw in its openat() function that allows an authenticated user to bypass normal access controls when requesting files with incorrect case. The module mistakenly treats the request as a new file creation and skips the standard permission checks, enabling the attacker to read or overwrite files owned by other users. The weakness is identified as CWE-178, a type‑sensitivity error.

The vulnerability affects Samba installations that enable the experimental vfs_ceph_rgw module. No specific release or patch version is indicated in the advisory, so any Samba deployment using this module remains potentially impacted. Administrators should verify whether their Samba version contains the fix and whether the module is enabled on shares.

The vulnerability carries a CVSS score of 8.1 but has no EPSS information and is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated to the Samba share; the attacker can then request a file using an alternate case and cause the server to perform an unintended write or read. The lack of exploitation data suggests the attack vector is likely a controlled environment where the attacker can manipulate file names. Despite the absence of a public exploit, the high severity score warrants prompt attention.