minio -- Privilege Escalation via Session Policy Bypass in Service Accounts and STS

mino reports:

A privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policies to bypass their inline policy restrictions when performing "own" account operations, specifically when creating new service accounts for the same user.

[source]