CVE-2024-24747

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.

• CWE-269

• https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776Patch
• https://github.com/minio/minio/releases/tag/RELEASE.2024-01-31T20-20-33ZPatch, Release Notes
• https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4Exploit, Patch, Vendor Advisory
• https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776Patch
• https://github.com/minio/minio/releases/tag/RELEASE.2024-01-31T20-20-33ZPatch, Release Notes
• https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4Exploit, Patch, Vendor Advisory

Published

Jan 31, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2474The Standout Color Boxes and Buttons plugin for WordPress is…6.4
• CVE-2024-24740SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.…5.3
• CVE-2024-24741SAP Master Data Governance for Material Data - versions 618,…4.3
• CVE-2024-24742SAP CRM WebClient UI - version S4FND 102, S4FND 103, S4FND 1…4.1
• CVE-2024-24743SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.…7.5
• CVE-2024-24746Loop with Unreachable Exit Condition ('Infinite Loop') vulne…7.5
• CVE-2024-24748Discourse is an open source platform for community discussio…5.3
• CVE-2024-24749GeoServer is an open source server that allows users to shar…7.5
• CVE-2024-2475The Media Library Assistant plugin for WordPress is vulnerab…5.4
• CVE-2024-24750Undici is an HTTP/1.1 client, written from scratch for Node.…6.5
• CVE-2024-24751sf_event_mgt is an event management and registration extensi…8.8
• CVE-2024-24752Bref enable serverless PHP on AWS Lambda. When Bref is used …6.5