CVE-2025-62506

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62506", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-15T15:03:28.133Z", "datePublished": "2025-10-16T21:17:28.219Z", "dateUpdated": "2025-10-23T19:03:46.367Z"}, "containers": {"cna": {"title": "MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/minio/minio/security/advisories/GHSA-jjjj-jwhf-8rgr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/minio/minio/security/advisories/GHSA-jjjj-jwhf-8rgr"}, {"name": "https://github.com/minio/minio/pull/21642", "tags": ["x_refsource_MISC"], "url": "https://github.com/minio/minio/pull/21642"}, {"name": "https://github.com/minio/minio/commit/c1a49490c78e9c3ebcad86ba0662319138ace190", "tags": ["x_refsource_MISC"], "url": "https://github.com/minio/minio/commit/c1a49490c78e9c3ebcad86ba0662319138ace190"}], "affected": [{"vendor": "minio", "product": "minio", "versions": [{"version": "< RELEASE.2025-10-15T17-29-55Z", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-16T21:17:28.219Z"}, "descriptions": [{"lang": "en", "value": "MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policies to bypass their inline policy restrictions when performing operations on their own account, specifically when creating new service accounts for the same user. The vulnerability exists in the IAM policy validation logic where the code incorrectly relied on the DenyOnly argument when validating session policies for restricted accounts. When a session policy is present, the system should validate that the action is allowed by the session policy, not just that it is not denied. An attacker with valid credentials for a restricted service or STS account can create a new service account for itself without policy restrictions, resulting in a new service account with full parent privileges instead of being restricted by the inline policy. This allows the attacker to access buckets and objects beyond their intended restrictions and modify, delete, or create objects outside their authorized scope. The vulnerability is fixed in version RELEASE.2025-10-15T17-29-55Z."}], "source": {"advisory": "GHSA-jjjj-jwhf-8rgr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-17T13:51:46.931611Z", "id": "CVE-2025-62506", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-17T13:52:00.479Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-10-23T19:03:46.367Z"}, "references": [{"url": "https://github.com/minio/minio/issues/21647"}, {"url": "https://news.ycombinator.com/item?id=45684035"}, {"url": "https://github.com/minio/minio/discussions/21655"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/minio/minio/issues/21647"}, {"url": "https://news.ycombinator.com/item?id=45684035"}, {"url": "https://github.com/minio/minio/discussions/21655"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-10-23T19:03:46.367Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62506", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-17T13:51:46.931611Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-17T13:51:51.666Z"}}], "cna": {"title": "MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS", "source": {"advisory": "GHSA-jjjj-jwhf-8rgr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "minio", "product": "minio", "versions": [{"status": "affected", "version": "< RELEASE.2025-10-15T17-29-55Z"}]}], "references": [{"url": "https://github.com/minio/minio/security/advisories/GHSA-jjjj-jwhf-8rgr", "name": "https://github.com/minio/minio/security/advisories/GHSA-jjjj-jwhf-8rgr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/minio/minio/pull/21642", "name": "https://github.com/minio/minio/pull/21642", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/minio/minio/commit/c1a49490c78e9c3ebcad86ba0662319138ace190", "name": "https://github.com/minio/minio/commit/c1a49490c78e9c3ebcad86ba0662319138ace190", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policies to bypass their inline policy restrictions when performing operations on their own account, specifically when creating new service accounts for the same user. The vulnerability exists in the IAM policy validation logic where the code incorrectly relied on the DenyOnly argument when validating session policies for restricted accounts. When a session policy is present, the system should validate that the action is allowed by the session policy, not just that it is not denied. An attacker with valid credentials for a restricted service or STS account can create a new service account for itself without policy restrictions, resulting in a new service account with full parent privileges instead of being restricted by the inline policy. This allows the attacker to access buckets and objects beyond their intended restrictions and modify, delete, or create objects outside their authorized scope. The vulnerability is fixed in version RELEASE.2025-10-15T17-29-55Z."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-16T21:17:28.219Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62506", "state": "PUBLISHED", "dateUpdated": "2025-10-23T19:03:46.367Z", "dateReserved": "2025-10-15T15:03:28.133Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-16T21:17:28.219Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "minio", "vendor": "minio", "versions": [{"status": "affected", "version": "< RELEASE.2025-10-15T17-29-55Z"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policies to bypass their inline policy restrictions when performing operations on their own account, specifically when creating new service accounts for the same user. The vulnerability exists in the IAM policy validation logic where the code incorrectly relied on the DenyOnly argument when validating session policies for restricted accounts. When a session policy is present, the system should validate that the action is allowed by the session policy, not just that it is not denied. An attacker with valid credentials for a restricted service or STS account can create a new service account for itself without policy restrictions, resulting in a new service account with full parent privileges instead of being restricted by the inline policy. This allows the attacker to access buckets and objects beyond their intended restrictions and modify, delete, or create objects outside their authorized scope. The vulnerability is fixed in version RELEASE.2025-10-15T17-29-55Z."}, {"lang": "es", "value": "MinIO es un sistema de almacenamiento de objetos de alto rendimiento. En todas las versiones anteriores a RELEASE.2025-10-15T17-29-55Z, una vulnerabilidad de escalada de privilegios permite a las cuentas de servicio y a las cuentas STS (Security Token Service) con pol\u00edticas de sesi\u00f3n restringidas eludir sus restricciones de pol\u00edtica en l\u00ednea al realizar operaciones en su propia cuenta, espec\u00edficamente al crear nuevas cuentas de servicio para el mismo usuario. La vulnerabilidad existe en la l\u00f3gica de validaci\u00f3n de pol\u00edticas de IAM donde el c\u00f3digo se bas\u00f3 incorrectamente en el argumento DenyOnly al validar pol\u00edticas de sesi\u00f3n para cuentas restringidas. Cuando una pol\u00edtica de sesi\u00f3n est\u00e1 presente, el sistema deber\u00eda validar que la acci\u00f3n est\u00e1 permitida por la pol\u00edtica de sesi\u00f3n, no solo que no est\u00e1 denegada. Un atacante con credenciales v\u00e1lidas para una cuenta de servicio o STS restringida puede crear una nueva cuenta de servicio para s\u00ed mismo sin restricciones de pol\u00edtica, lo que resulta en una nueva cuenta de servicio con privilegios parentales completos en lugar de estar restringida por la pol\u00edtica en l\u00ednea. Esto permite al atacante acceder a buckets y objetos m\u00e1s all\u00e1 de sus restricciones previstas y modificar, eliminar o crear objetos fuera de su \u00e1mbito autorizado. La vulnerabilidad est\u00e1 corregida en la versi\u00f3n RELEASE.2025-10-15T17-29-55Z."}], "id": "CVE-2025-62506", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62506", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-17T13:51:46.931611Z", "version": "2.0.3"}}]}, "published": "2025-10-16T22:15:31.703", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/minio/minio/commit/c1a49490c78e9c3ebcad86ba0662319138ace190"}, {"source": "security-advisories@github.com", "url": "https://github.com/minio/minio/pull/21642"}, {"source": "security-advisories@github.com", "url": "https://github.com/minio/minio/security/advisories/GHSA-jjjj-jwhf-8rgr"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/minio/minio/discussions/21655"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/minio/minio/issues/21647"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://news.ycombinator.com/item?id=45684035"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-20T13:25:02.143845+00:00", "updated": "2025-10-20T13:25:02.143877+00:00", "vendors": ["minio", "minio$PRODUCT$minio"]}