From versions 1.64.0 to 1.75.1, rclone’s FTP auth‑proxy driver stores passwords in a global map by username instead of per session. If two authenticated sessions share the same username but connect to different backend proxies, the later login overwrites the stored password, and subsequent file system operations on the first session use the second credential’s backend. This allows the first session to read, create, overwrite, rename, or delete objects with the permissions of the second backend. The weakness is a concrete example of Incorrect Resource Allocation (CWE‑488).

The vulnerability affects rclone rclone versions 1.64.0 through 1.75.1. All users running these versions are susceptible unless they run an unpatched release.

The CVSS score of 7.3 classifies this as high‑severity. The EPSS score is not available, and the issue is not yet listed in the CISA KEV catalog. Exploitation requires the attacker to have the the second session remaining active while the first is still open. The likely attack vector is a remote user connecting to an exposed rclone FTP server or a local user with shared access to multiple sessions. Because it allows the abuse of backend authority, the incident could lead to loss, alteration, or deletion of cloud data.