The vulnerability resides in SeaweedFS’s Filer component, where the allowed_prefixes authorization check performed a simple literal prefix comparison. A JWT token that was scoped to a tenant such as "/tenant1" was therefore treated as valid for any path that began with that prefix. This simple check unintentionally authorized access to sibling paths like "/tenant1234", "/tenant1-old", and "/tenant1backup", enabling an attacker possessing a valid scoped token to read or write data belonging to other tenants. The flaw constitutes a failure of authorization and results in privilege escalation for cross‑tenant data exposure.

SeaweedFS, the distributed storage system released by the SeaweedFS organization. All deployments running a version older than 4.24 are vulnerable, regardless of specific configuration, because the bug existed in the core filer server handlers code. The issue does not affect later releases which apply the fix.

The CVSS score for this issue is 8.1, indicating a high severity of authorization failure. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not currently known‑exploited at scale. An attacker can exploit the flaw remotely by issuing a JWT that is scoped to a single tenant; the server will accept that token for any path that shares the same prefix, thereby allowing cross‑tenant reads or writes. Although the attacker requires a valid token, acquiring one is feasible in environments that issue broad‑scope tokens or rely on shared credentials.