Privilege Escalation Flaw Discovered in MinIO Service Accounts — CVE-2025-62506

MinIO has disclosed a high-severity privilege escalation vulnerability, CVE-2025-62506, with CVSS 8.1, that could allow attackers to bypass session policy restrictions and gain elevated permissions via service accounts and security tokens. According to MinIO team, the flaw lies in IAM policy validation logic in cmd/iam[.]go, where the DenyOnly argument is incorrectly relied upon when validating restricted accounts performing operations on their own account.

In practice, a restricted session policy may be applied, but the system would not properly enforce whether the requested action is explicitly allowed, enabling unintended privilege escalation.

MinIO provides a scenario in which an administrator creates a restricted service or STS account and that account then creates a new service account under the same parent user, inheriting full parent privileges rather than the original restrictions, enabling actions across buckets such as reading, modifying or deleting objects.

The issue was fixed in pull request #21642 and users are advised to upgrade to the latest stable version, for example via go install -v github[.]com/minio/minio@RELEASE.2025-10-15T17-29-55Z, along with auditing service accounts and reviewing access logs.