An authenticated S3 user who has permission to modify the ACL of a nested object can, by calling PutObjectAcl, overwrite a different object that resides outside the intended scope. The request is authorized against the nested key but the updated ACL entry is written to the bucket root, causing the target object to be replaced with the contents, metadata, owner and ACL of the scoped object. The effect is a complete data overwrite and a break of the object‑level access controls. The vulnerability permits an attacker who is authenticated against SeaweedFS’s S3 interface to overwrite any object at the bucket root that shares the same basename as a permitted nested key. The exploit does not require additional privileges; it simply exploits the mis‑written ACL update logic. The CVSS score of 7.1 indicates a moderate severity, and there is no EPSS data or KEV listing. Because the flaw requires authentication, the attack vector is limited to legitimate S3 accounts, but once such an account is compromised the attacker can overwrite arbitrary objects in the bucket, leading to data loss or corruption. The overall risk is therefore moderate to high depending on the criticality of the overwritten objects.

SeaweedFS SeaweedFS, versions prior to 4.40 are affected. The issue is present in all releases before the 4.40 update.

The vulnerability can be exploited by any authenticated S3 client with ACL modification rights on a nested key. The exploit path is straightforward: invoke PutObjectAcl on the allowed object, and the system will silently write the updated entry to the bucket root, overwriting the target object. Because the update carries complete object data, the existing object is replaced entirely. The risk of exploitation depends on the presence of vulnerable credentials; there is no public exploit, and the EPSS score is not available, but the practical impact is significant when exploited.