{"schema":"threatline.record/2","record":{"id":"CVE-2026-109411","aliases":[],"summary":"Samba: access control bypass via vfs_ceph_rgw case-insensitive open","details":"An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.","categories":["Unclassified"],"product":"Samba","vendor":"Samba","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109411","source_modified_at":"2026-10-28T19:17:45.459Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Samba","vendor":"Samba","versions":[{"status":"affected","version":"4.25.0","lessThan":"4.25.1","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109411","source_modified_at":"2026-10-28T19:17:45.459Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109411","source_modified_at":"2026-10-28T19:17:45.459Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat","versions":[],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109411","source_modified_at":"2026-10-28T19:17:45.459Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat","versions":[],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109411","source_modified_at":"2026-10-28T19:17:45.459Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat","versions":[],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109411","source_modified_at":"2026-10-28T19:17:45.459Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109411","source_modified_at":"2026-10-28T19:17:45.459Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109411","source_modified_at":"2026-10-28T19:17:45.459Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat","versions":[],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109411","source_modified_at":"2026-10-28T19:17:45.459Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat","versions":[],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109411","source_modified_at":"2026-10-28T19:17:45.459Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"Samba","ecosystem":null},"version":"4.25.1","basis":"first unaffected version stated in the CVE record"}],"cvss":8.1,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T19:17:45.459Z","modified_at":"2026-10-28T19:17:45.459Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-109411","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T19:17:45.459Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2026-109411","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://attachments.samba.org/attachment.cgi?id=19294"},{"source":"CVE List","url":"https://attachments.samba.org/attachment.cgi?id=19295"},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552136","tags":["issue-tracking","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.samba.org/show_bug.cgi?id=16276"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T19:17:45.459Z","content_hash":"73f1b10bbc580a07035521fcec515e373e82043d923c3b249e8479c67eefd799"}}