SeaweedFS distributes object storage through an S3-compatible API. In versions 4.39 and earlier the API accepts an external OIDC JSON Web Token that is presented directly in the Authorization header. The token is mapped to an IAM role without enforcing that role’s trust policy. Consequently, a federated user can assume a role for which the trust policy would normally deny access, and then obtain the role’s S3 permissions. This vulnerability is a form of unauthorized privilege escalation and corresponds to CWE‑863, Incomplete Permissions Check.

The affected product is SeaweedFS, a distributed file and blob storage system. Versions 4.39 and older are impacted; the fault is addressed in version 4.40 and later.

The CVSS score of 8.7 classifies the flaw as high severity. Exploit probability data from EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker who can acquire a valid OIDC token issued to a federated user can send that token directly to the S3 API, bypassing the trust evaluation step that STS AssumeRoleWithWebIdentity would enforce. This allows the attacker to obtain the full permissions attached to the role, including read, write, and delete access to any object the role permits. The attack does not require system compromise beyond the possession of a legitimate OIDC token, making it a low‑barrier privilege escalation.