RustFS is a distributed object storage system built in Rust. Prior to alpha.90, RustFS contains a missing authorization check in the multipart copy path (UploadPartCopy). A low-privileged user who cannot read objects from a victim bucket can still exfiltrate victim objects by copying them into an attacker-controlled multipart upload and completing the upload. This breaks tenant isolation in multi-user / multi-tenant deployments. This vulnerability is fixed in alpha.90.

Affected: crates.io: rustfs

RustFS contains a missing authorization check in the multipart copy path (`UploadPartCopy`). A low-privileged user who cannot read objects from a victim bucket can still exfiltrate victim objects by copying them into an attacker-controlled multipart upload and completing the upload.

This breaks tenant isolation in multi-user / multi-tenant deployments.

## Impact **Unauthorized cross-bucket / cross-tenant data exfiltration (Confidentiality: High).**

An attacker with only minimal permissions on their own bucket (multipart upload + Put/Get on destination objects) can copy and retrieve objects from a victim bucket **without** having `s3:GetObject` (or equivalent) permission on the source.

In the attached PoC, the attacker successfully exfiltrates a 5MB private object and proves integrity via matching SHA256 and size.

## Threat Model (Realistic) - **Victim tenant/user** owns a bucket (e.g., `victim-bucket-*`) and stores private objects (e.g., `private/finance_dump.bin`). - **Attacker tenant/user** has **no permissions** on the victim bucket: - cannot `ListObjects`, `HeadObject`, `GetObject`, or `CopyObject` from the victim bucket. - Attacker has **minimal permissions only on attacker bucket**: - `CreateMultipartUpload`, `UploadPart`, `UploadPartCopy`, `CompleteMultipartUpload`, `AbortMultipartUpload`, - and `PutObject`/`GetObject` for objects in attacker bucket. - Despite this, attacker can exfiltrate victim objects via multipart copy.

## Root Cause Analysis The acces…