CVE-2022-24842 Improper Privilege Management in MinIO

What is CVE-2022-24842?

CVE-2022-24842 is a high-severity vulnerability in minio, published on 12 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RELEASE.2022-04-12T06-55-35Z`. Users unable to upgrade may workaround this issue by explicitly adding a `admin:CreateServiceAccount` deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well.

Weakness: CWE-269

Which versions are affected by CVE-2022-24842?

It affects 1 product.

Products include Minio Minio.

How do I fix CVE-2022-24842?

No fix has been published for CVE-2022-24842 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-24842 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24842 exists.

Other vulnerabilities in minio

• CVE-2023-28434 MinIO Security Feature Bypass Exploited High 8.8
• CVE-2023-28432 MinIO Information Disclosure Exploited High 7.5
• CVE-2020-11012 Authentication bypass MinIO Admin API Critical 9.3
• CVE-2026-33322 MinIO: JWT Algorithm Confusion in OIDC Authentication Critical 9.2
• CVE-2026-33419 MinIO: LDAP login brute-force via user enumeration and missing rate limit Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2j69-jjmg-534q.