CVE-2022-24842 - CVE House
Back to Database
Status published High CVE-2022-24842

Improper Privilege Management in MinIO

Vulnerability Description

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RELEASE.2022-04-12T06-55-35Z`. Users unable to upgrade may workaround this issue by explicitly adding a `admin:CreateServiceAccount` deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24842

Credits & Attribution

No credits recorded in the NVD database.

References

More from minio

View All →
CVE-2025-62506
MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS
High 8.1
CVE-2025-59952
minio-java Client XML Tag is Vulnerable to Value Substitution
High 8.7
CVE-2025-32963
Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS
Medium 6.9
CVE-2025-31489
MinIO performs incomplete signature validation for unsigned-trailer uploads
High 8.7
CVE-2025-27414
MinIO SFTP authentication bypass due to improperly trusted SSH key
Medium 4.6

Affected Vendor

Affected Software

minio
Vulnerable Versions:
< RELEASE.2022-04-12T06-55-35Z

Timeline

Official Publish: April 12th, 2022
Last Modified: April 22nd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-269

MITRE ATT&CK TTPs

T1078 Valid Accounts
Persistence
T1098 Account Manipulation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1222 File and Directory Permissions Modification
Defense Evasion
T1134 Access Token Manipulation
Defense Evasion