An authorization bypass exists in the /credentials/signurl endpoint of Rucio. The API reads the X‑Rucio‑Account header instead of the account value supplied by the authenticated token, allowing any authenticated low‑privilege user to supply a header value of "root". This bypass satisfies the root‑only get_signed_url permission check and leads the server to generate a presigned URL for read, write or delete operations on arbitrary cloud storage objects. Due to the presence of an X‑Rucio‑VO header, an attacker may also select another tenant in multi‑VO deployments, enabling cross‑tenant data access.

The vulnerability affects the Rucio framework from version 1.16.1 up to and including 35.9.0, 38.6.0, and 41.0.0rc1. All users of these releases are at risk if they have the ability to specify the X‑Rucio‑Account header in authenticated requests.

With a CVSS score of 8.1 this issue is high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires only that the attacker be an authenticated user with low privilege, enabling straightforward subversion of authorization controls. Successful exploitation can lead to data disclosure, modification, deletion, and cross‑tenant access on cloud‑backed RSEs.