{"schema_version":"1.9.0","id":"CVE-2024-55949","published":"2024-12-16T20:02:00.856Z","modified":"2026-08-12T03:51:42.780544994Z","aliases":["BIT-minio-2024-55949","GHSA-cwq8-g58r-32hg","GO-2024-3336"],"related":["openSUSE-SU-2024:14603-1"],"summary":"Privilege escalation in IAM import API in MinIO","details":"MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/minio/minio","events":[{"introduced":"bd099f5e71d0ea511846372869bfcb280a5da2f6"},{"fixed":"580d9db85e04f1b63cc2909af50f0ed08afa965f"},{"fixed":"f246c9053f9603e610d98439799bdd2a6b293427"}],"database_specific":{"extracted_events":[{"introduced":"RELEASE.2022-06-25T15-50-16Z"},{"fixed":"RELEASE.2024-12-13T22-19-12Z"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["RELEASE.2024-11-07T00-52-20Z","RELEASE.2024-10-29T16-01-48Z","RELEASE.2024-10-13T13-34-11Z","RELEASE.2024-10-02T17-50-41Z","RELEASE.2024-09-22T00-33-43Z","RELEASE.2024-09-13T20-26-02Z","RELEASE.2024-09-09T16-59-28Z","RELEASE.2024-08-29T01-40-52Z","RELEASE.2024-08-26T15-33-07Z","RELEASE.2024-08-17T01-24-54Z","RELEASE.2024-08-03T04-33-23Z","RELEASE.2024-07-31T05-46-26Z","RELEASE.2024-07-29T22-14-52Z","RELEASE.2024-07-26T20-48-21Z","RELEASE.2024-07-16T23-46-41Z","RELEASE.2024-07-15T19-02-30Z","RELEASE.2024-07-13T01-46-15Z","RELEASE.2024-07-10T18-41-49Z","RELEASE.2024-07-04T14-25-45Z","RELEASE.2024-06-29T01-20-47Z","RELEASE.2024-06-28T09-06-49Z","RELEASE.2024-06-26T01-06-18Z","RELEASE.2024-06-22T05-26-45Z","RELEASE.2024-06-13T22-53-53Z","RELEASE.2024-06-11T03-13-30Z","RELEASE.2024-06-06T09-36-42Z","RELEASE.2024-06-04T19-20-08Z","RELEASE.2024-05-28T17-19-04Z","RELEASE.2024-05-27T19-17-46Z","RELEASE.2024-05-10T01-41-38Z","RELEASE.2024-05-07T06-41-25Z","RELEASE.2024-05-01T01-11-10Z","RELEASE.2024-04-28T17-53-50Z","RELEASE.2024-04-18T19-09-19Z","RELEASE.2024-04-06T05-26-02Z","RELEASE.2024-03-30T09-41-56Z","RELEASE.2024-03-26T22-10-45Z","RELEASE.2024-03-21T23-13-43Z","RELEASE.2024-03-15T01-07-19Z","RELEASE.2024-03-10T02-53-48Z","RELEASE.2024-03-07T00-43-48Z","RELEASE.2024-03-05T04-48-44Z","RELEASE.2024-03-03T17-50-39Z","RELEASE.2024-02-26T09-33-48Z","RELEASE.2024-02-24T17-11-14Z","RELEASE.2024-02-17T01-15-57Z","RELEASE.2024-02-14T21-36-02Z","RELEASE.2024-02-13T15-35-11Z","RELEASE.2024-02-12T21-02-27Z","RELEASE.2024-02-09T21-25-16Z","RELEASE.2024-02-06T21-36-22Z","RELEASE.2024-02-04T22-36-13Z","RELEASE.2024-01-31T20-20-33Z","RELEASE.2024-01-29T03-56-32Z","RELEASE.2024-01-28T22-35-53Z","RELEASE.2024-01-18T22-51-28Z","RELEASE.2024-01-16T16-07-38Z","RELEASE.2024-01-13T07-53-03Z","RELEASE.2024-01-11T07-46-16Z","RELEASE.2024-01-05T22-17-24Z","RELEASE.2024-01-01T16-36-33Z","RELEASE.2023-12-23T07-19-11Z","RELEASE.2023-12-20T01-00-02Z","RELEASE.2023-12-14T18-51-57Z","RELEASE.2023-12-13T23-28-55Z","RELEASE.2023-12-09T18-17-51Z","RELEASE.2023-12-07T04-16-00Z","RELEASE.2023-12-06T09-09-22Z","RELEASE.2023-12-02T10-51-33Z","RELEASE.2023-11-20T22-40-07Z","RELEASE.2023-11-15T20-43-25Z","RELEASE.2023-11-11T08-14-41Z","RELEASE.2023-11-06T22-26-08Z","RELEASE.2023-11-01T18-37-25Z","RELEASE.2023-11-01T01-57-10Z","RELEASE.2023-10-25T06-33-25Z","RELEASE.2023-10-24T04-42-36Z","RELEASE.2023-10-16T04-13-43Z","RELEASE.2023-10-14T05-17-22Z","RELEASE.2023-10-07T15-07-38Z","RELEASE.2023-09-30T07-02-29Z","RELEASE.2023-09-27T15-22-50Z","RELEASE.2023-09-23T03-47-50Z","RELEASE.2023-09-20T22-49-55Z","RELEASE.2023-09-16T01-01-47Z","RELEASE.2023-09-07T02-05-02Z","RELEASE.2023-09-04T19-57-37Z","RELEASE.2023-08-31T15-31-16Z","RELEASE.2023-08-29T23-07-35Z","RELEASE.2023-08-23T10-07-06Z","RELEASE.2023-08-16T20-17-30Z","RELEASE.2023-08-09T23-30-22Z","RELEASE.2023-08-04T17-40-21Z","RELEASE.2023-07-21T21-12-44Z","RELEASE.2023-07-18T17-49-40Z","RELEASE.2023-07-11T21-29-34Z","RELEASE.2023-07-07T07-13-57Z","RELEASE.2023-06-29T05-12-28Z","RELEASE.2023-06-23T20-26-00Z","RELEASE.2023-06-19T19-52-50Z","RELEASE.2023-06-16T02-41-06Z","RELEASE.2023-06-09T07-32-12Z","RELEASE.2023-06-02T23-17-26Z","RELEASE.2023-05-27T05-56-19Z","RELEASE.2023-05-18T00-05-36Z","RELEASE.2023-05-04T21-44-30Z","RELEASE.2023-04-28T18-11-17Z","RELEASE.2023-04-20T17-56-55Z","RELEASE.2023-04-13T03-08-07Z","RELEASE.2023-04-07T05-28-58Z","RELEASE.2023-03-24T21-41-23Z","RELEASE.2023-03-22T06-36-24Z","RELEASE.2023-03-20T20-16-18Z","RELEASE.2023-03-13T19-46-17Z","RELEASE.2023-03-09T23-16-13Z","RELEASE.2023-02-27T18-10-45Z","RELEASE.2023-02-22T18-23-45Z","RELEASE.2023-02-17T17-52-43Z","RELEASE.2023-02-10T18-48-39Z","RELEASE.2023-02-09T05-16-53Z","RELEASE.2023-01-31T02-24-19Z","RELEASE.2023-01-25T00-19-54Z","RELEASE.2023-01-20T02-05-44Z","RELEASE.2023-01-18T04-36-38Z","RELEASE.2023-01-12T02-06-16Z","RELEASE.2023-01-06T18-11-18Z","RELEASE.2023-01-02T09-40-09Z","RELEASE.2022-12-12T19-27-27Z","RELEASE.2022-12-07T00-56-37Z","RELEASE.2022-12-02T19-19-22Z","RELEASE.2022-11-29T23-40-49Z","RELEASE.2022-11-26T22-43-32Z","RELEASE.2022-11-17T23-20-09Z","RELEASE.2022-11-11T03-44-20Z","RELEASE.2022-11-10T18-20-21Z","RELEASE.2022-11-08T05-27-07Z","RELEASE.2022-10-29T06-21-33Z","RELEASE.2022-10-24T18-35-07Z","RELEASE.2022-10-21T22-37-48Z","RELEASE.2022-10-20T00-55-09Z","RELEASE.2022-10-15T19-57-03Z","RELEASE.2022-10-08T20-11-00Z","RELEASE.2022-10-05T14-58-27Z","RELEASE.2022-10-02T19-29-29Z","RELEASE.2022-09-25T15-44-53Z","RELEASE.2022-09-22T18-57-27Z","RELEASE.2022-09-17T00-09-45Z","RELEASE.2022-09-07T22-25-02Z","RELEASE.2022-09-01T23-53-36Z","RELEASE.2022-08-26T19-53-15Z","RELEASE.2022-08-25T07-17-05Z","RELEASE.2022-08-22T23-53-06Z","RELEASE.2022-08-13T21-54-44Z","RELEASE.2022-08-11T04-37-28Z","RELEASE.2022-08-08T18-34-09Z","RELEASE.2022-08-05T23-27-09Z","RELEASE.2022-08-02T23-59-16Z","RELEASE.2022-07-30T05-21-40Z","RELEASE.2022-07-29T19-40-48Z","RELEASE.2022-07-26T00-53-03Z","RELEASE.2022-07-24T17-09-31Z","RELEASE.2022-07-24T01-54-52Z","RELEASE.2022-07-17T15-43-14Z","RELEASE.2022-07-15T03-44-22Z","RELEASE.2022-07-13T23-29-44Z","RELEASE.2022-07-08T00-05-23Z","RELEASE.2022-07-06T20-29-49Z","RELEASE.2022-07-04T21-02-54Z","RELEASE.2022-06-30T20-58-09Z","RELEASE.2022-06-25T15-50-16Z"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55949.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55949.json"},{"type":"ADVISORY","url":"https://github.com/minio/minio/security/advisories/GHSA-cwq8-g58r-32hg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55949"},{"type":"FIX","url":"https://github.com/minio/minio/commit/580d9db85e04f1b63cc2909af50f0ed08afa965f"},{"type":"FIX","url":"https://github.com/minio/minio/commit/f246c9053f9603e610d98439799bdd2a6b293427"},{"type":"FIX","url":"https://github.com/minio/minio/pull/20756"}],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-269"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55949.json"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}