RustFS, a distributed object storage system written in Rust, contains a flaw in the ListObjectVersions operation that allows unauthenticated users to retrieve metadata about all object versions in a bucket. The bug occurs when a bucket policy does not explicitly grant permission for ListObjectVersions; the code falls back to performing an S3 ListBucket check and exits before the deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets policies can be evaluated. As a result, a public bucket that permits listing of its contents can still expose the entire version history through GET /<bucket>?versions=, while GetObject requests for individual versions remain denied. This flaw leads to an information‑disclosure vulnerability in the data plane."

The vulnerability affects the RustFS product from the rustfs vendor. All releases prior to version 1.0.0-beta.12 are impacted. In particular, any deployment that has enabled public bucket listing in a bucket that does not grant ListObjectVersions permission is susceptible. No newer releases contain the fix, so all earlier builds must be inspected for this behavior.

The CVSS score of 5.3 indicates moderate impact from an authorization, information‑disclosure perspective. Because the flaw requires unauthenticated access to a public bucket, a remote attacker could trivially trigger the exploit by issuing a GET request with the ?versions parameter. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation is publicly known. Nonetheless, the ability to enumerate all object versions in a public bucket can assist attackers in fingerprinting object lifecycle or planning further attacks by identifying objects that may be targeted for deletion or tampering.