The vulnerability allows an authenticated low‑privilege user to hijack another tenant’s TUS upload session and write data to a filer path outside their allowed prefixes, effectively bypassing the JWT‑based scoping. This unauthorized write can corrupt or replace files owned by other tenants, compromising data integrity and potentially leading to information disclosure if malicious content is inserted. The weakness is an Authorization Bypass through Privilege Escalation (CWE‑639).

SeaweedFS deployments using the filer component with JWT signing enabled and TUS resumable uploads activated are impacted. The issue exists in version 4.39 and earlier; it was addressed in version 4.40. Only installations that have configured the filer to use JWT signing with allowed_prefixes and have the TUS upload feature turned on are susceptible; systems without these settings are not affected.

The CVSS score of 7.6 denotes a high impact vulnerability that is fully authenticated. Although the EPSS score is not available, the lack of public exploitation in the CISA KEV catalog suggests a moderate threat level; however, attackers could leverage credentials they already possess or obtain session identifiers via other vulnerability or social engineering techniques. The attack path requires an authenticated tenant to obtain another tenant’s session ID and then issue PATCH, HEAD, or DELETE requests against it, bypassing the intended prefix restrictions. Given the severity, organizations with exposed SeaweedFS installations should consider the vulnerability high risk until mitigated.