https://silo.pgsty.com/tags/iam/ Recent content in IAM on SILO Hugo en Wed, 26 Aug 2026 00:32:49 +0800 https://silo.pgsty.com/blog/security/cve-2025-62506/ Wed, 15 Oct 2025 00:00:00 +0000 https://silo.pgsty.com/blog/security/cve-2025-62506/ <p><strong>Status:</strong> Inherited and released<br> <strong>First Silo community release:</strong> <a href="https://github.com/pgsty/silo/releases/tag/RELEASE.2025-12-03T12-00-00Z">RELEASE.2025-12-03T12-00-00Z</a><br> <strong>Upstream fixed release:</strong> <a href="https://github.com/minio/minio/releases/tag/RELEASE.2025-10-15T17-29-55Z">RELEASE.2025-10-15T17-29-55Z</a><br> <strong>GitHub advisory:</strong> <a href="https://github.com/advisories/GHSA-jjjj-jwhf-8rgr">GHSA-jjjj-jwhf-8rgr</a><br> <strong>Upstream fix:</strong> <a href="https://github.com/minio/minio/pull/21642">minio/minio#21642</a></p> <p>A service account or STS account with a restricted session policy could use an &ldquo;own account&rdquo; operation to create another service account without the restriction. The child account then inherited broader parent permissions, turning valid low-privilege credentials into a privilege-escalation path.</p> <p>Silo did not need a separate backport. The upstream fix and its two regression groups were already in the history from which the community fork was released. This note records that inheritance without duplicating the tests or reconstructing the investigation already captured by the upstream advisory and PR.</p>