CVE-2023-27589: Minio vulnerable to denial of access by an admin privileged user for root credential
Vulnerability summary
CVE-2023-27589 is a medium (CVSS 6.5) Improper Privilege Management vulnerability in minio. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 59.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 14-03-2023PublishedVulnerability first disclosed.
- 25-02-2025Last modifiedVulnerability information updated.
Description
Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z. There are ways to work around this via adding higher privileges to the disabled root user via `mc admin policy set`.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
0.90%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.90% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundMinio
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Minio1 product
- minio≥ RELEASE.2020-12-23T02-24-12Z, < RELEASE.2023-03-13T19-46-17Z | ≥ 2020-12-23t02-24-12z, < 2023-03-13t19-46-17z
1 vendor · 1 product