CVE-2024-24747

CVE-2024-24747 is a high-severity privilege escalation vulnerability affecting MinIO High Performance Object Storage versions prior to RELEASE.2024-01-31T20-20-33Z. This flaw allows an attacker with legitimate access to create an access key that inherits overly permissive "admin" rights from a parent key, enabling them to bypass intended S3 permissions and escalate privileges. With a CVSS score of 8.8, this vulnerability is easily exploitable over the network with low privileges, potentially leading to full compromise of confidentiality, integrity, and availability. While not currently listed on the CISA KEV catalog or showing significant community discussion, public exploit code (EDB-51976) is available, indicating a clear path for exploitation. Organizations using affected MinIO versions should prioritize patching to mitigate this risk.