The core issue in CVE-2026-73287 is straightforward: the FTPS driver in this distributed storage system skips the authorization check that the S3 driver properly enforces. Specifically, FtpsDriver::mkd executes S3Action::CreateBucket without calling authorize_operation first, allowing authenticated FTPS users to create buckets they shouldn't have access to.
This is not merely a single missing function call—it signals a fragmented authorization model where security was implemented for the primary S3 interface and then inconsistently applied to secondary protocol handlers. The narrow exploitation surface (only authenticated FTPS users lacking s3:CreateBucket) should not comfort you. What matters more than the CVSS score is the blast radius: unauthorized buckets created through this bypass get replicated across nodes, indexed, and exposed to other protocol paths that may correctly enforce authorization but now operate on corrupted state assumptions. In a distributed system, the failure cascade is the real vulnerability, not the bypass itself.
Your priority: audit other protocol drivers (HDFS, NFS, proprietary interfaces) for the same pattern. If authorize_operation is something developers must remember to invoke rather than something the architecture makes mandatory, the next CVE is already waiting. Also verify whether the fix includes reconciliation logic to detect and clean up buckets created during the vulnerable window—without that, you're patching the authorization gate while orphaned unauthorized state keeps propagating.
The beta versioning (1.0.0-beta.12) amplifies concern: immature error handling and state reconciliation in distributed storage can produce unpredictable failure cascades when authorization bypasses create unexpected state. Don't let the low EPSS score and medium CVSS lull you into deprioritizing this—the combination of narrow exploitability with potentially wide failure propagation is exactly when analysts should pay closest attention.