CVE-2023-25812: MinIO

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue.

Affected products

• MinIO MinIO: from 2020-04-10t03-34-42z, before 2023-02-17t17-52-43z (fixed in 2023-02-17t17-52-43z)

Published 2023-02-21. Last modified 2026-06-17.