From fa1554be7ff3e5cd1bbd6f65c4ccc960739d6260 Mon Sep 17 00:00:00 2001 From: loverustfs Date: Wed, 22 Apr 2026 20:16:09 +0800 Subject: [PATCH] fix(admin): authorize cross-user ListServiceAccount with ListServiceAccount (#2640) --- rustfs/src/admin/handlers/service_account.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/rustfs/src/admin/handlers/service_account.rs b/rustfs/src/admin/handlers/service_account.rs index 68e8c75d1..6d5818c5a 100644 --- a/rustfs/src/admin/handlers/service_account.rs +++ b/rustfs/src/admin/handlers/service_account.rs @@ -925,11 +925,13 @@ impl Operation for ListServiceAccount { }; let target_account = if query.user.as_ref().is_some_and(|v| v != &cred.access_key) { + // Cross-user listing must be authorized by ListServiceAccounts, matching the + // sibling InfoServiceAccount/InfoAccessKey/ListAccessKeysBulk handlers. if !iam_store .is_allowed(&Args { account: &cred.access_key, groups: &cred.groups, - action: Action::AdminAction(AdminAction::UpdateServiceAccountAdminAction), + action: Action::AdminAction(AdminAction::ListServiceAccountsAdminAction), bucket: "", conditions: &get_condition_values( &req.headers,