RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/hand…

RustFS distributed object storage system contains an authorization bypass vulnerability in notification target admin API endpoints. The vulnerability exists in rustfs/src/admin/handlers/event.rs where four endpoints use check_permissions helper that validates authentication only without performing admin-action authorization via validate_admin_request. Non-admin users can overwrite admin-defined notification targets by name, causing bucket events to be delivered to attacker-controlled endpoints. This enables cross-user event interception and audit evasion. The vulnerability affects versions prior to 1.0.0-alpha.94 which contains a patch.