PutObject with ?versionId= lets a writer overwrite an existing object version without DeleteObjectVersion permission

Summary

On a versioning-enabled bucket, any principal that holds only s3:PutObject on a key can overwrite the content of an existing, specific object version by sending PUT /bucket/key?versionId=. The version keeps its id and the old content is replaced in place, so a writer without s3:DeleteObjectVersion can rewrite object history that versioning is meant to preserve. The same applies to browser POST uploads carrying ?versionId=.

Details

• rustfs/src/app/object/put.rs passes PutObjectInput.version_id (taken from the versionId query parameter) into put_opts_with_replication_authorization.
• rustfs/src/storage/options.rs put_opts_with_replication_authorization uses that query vid unconditionally; only the header fallback (SUFFIX_SOURCE_VERSION_ID) is gated on replication_request_authorized. The resulting opts.version_id makes the write replace that version.
• The put_object access hook asks only for s3:PutObject (rustfs/src/storage/access.rs around line 3175); no version-specific or delete-version permission is required.
• Object-locked versions are protected by validate_existing_object_lock_for_write; unlocked versions are not.
• Reproduced (2026-09-30) against a debug build of RustFS main served by the current HTTP stack: after PUT key (10 bytes) on a versioned bucket, PUT key?versionId= with 20 bytes left a single version with the same id whose content is the new 20 bytes.

Impact

Integrity: a principal limited to `s3:…