RustFS’s AddServiceAccount handler accepts a user-specified target_user after only verifying that the caller has CreateServiceAccountAdminAction. The handler then creates a new service account and marks it as a root‑parent by setting is_owner, effectively granting the caller full ownership privileges. Because of this lack of proper ownership validation, an attacker can create service accounts with root‑parent status, enabling them to acquire full control over store resources. The weakness is categorized as CWE-269, Privilege Escalation.

The vulnerable product is rustfs:rustfs, the distributed object storage system written in Rust. Versions prior to 1.0.0‑beta.11 contain the flaw; the issue is fixed in that release and any newer releases.

The CVSS score of 8.8 marks this flaw as high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the potential for an attacker already capable of invoking the AddServiceAccount handler to create root‑parent service accounts remains significant. The likely attack vector is via the exposed handler/API which, once accessed by an authorized (or compromised) administrator, allows creation of privileged accounts without further checks. A compromised admin credential or an attacker with access to the administration interface could exploit this to gain full control of the storage system.