MinIO up to RELEASE.2025-04-03T14-56-28Z Security Token Service authorization

Summaryinfo

A vulnerability has been found in MinIO and classified as critical. This affects an unknown part of the component Security Token Service. This manipulation causes authorization. This vulnerability is handled as CVE-2025-62506. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in MinIO and classified as critical. Affected by this vulnerability is an unknown part of the component Security Token Service. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policies to bypass their inline policy restrictions when performing operations on their own account, specifically when creating new service accounts for the same user. The vulnerability exists in the IAM policy validation logic where the code incorrectly relied on the DenyOnly argument when validating session policies for restricted accounts. When a session policy is present, the system should validate that the action is allowed by the session policy, not just that it is not denied. An attacker with valid credentials for a restricted service or STS account can create a new service account for itself without policy restrictions, resulting in a new service account with full parent privileges instead of being restricted by the inline policy. This allows the attacker to access buckets and objects beyond their intended restrictions and modify, delete, or create objects outside their authorized scope. The vulnerability is fixed in version RELEASE.2025-10-15T17-29-55Z.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-62506 since 10/15/2025. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version RELEASE.2025-10-15T17-29-55Z eliminates this vulnerability. Applying the patch c1a49490c78e9c3ebcad86ba0662319138ace190 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-2331). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Open Source MinIO

Productinfo

Name

• MinIO

Version

• 0.12.3
• 8.6.0
• 2021-01-30T00-20-58Z
• 2021-03-17T02-33-02Z
• 2021-10-10T16-53-30Z
• 2021-10-13T00-23-17Z
• 2022-04-12T06-55-35Z
• 2023-03-20T20-16-18Z
• <=0.12.2
• <=8.5
• <=2022-06-02T02-11-04Z
• RELEASE.2020-04-23T00-58-49Z
• RELEASE.2021-03-04T00-53-13Z
• RELEASE.2021-12-27T07-23-18Z
• RELEASE.2024-01-31T20-20-33Z
• RELEASE.2024-05-27T19-17-46Z
• RELEASE.2024-12-13T22-19-12Z
• RELEASE.2025-02-28T09-55-16Z
• RELEASE.2025-04-03T14-56-28Z

License

• open-source

Website

• Product: https://github.com/minio/minio/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion