On shares using the vfs_ceph_rgw module, the module's openat() implementation ignored the (possibly case-corrected) filename supplied by the file server and instead re-opened the name originally sent by
the client.

When a client opened an existing file using a different case than it exists on disk with a create disposition of FILE_OPEN_IF, the case-insensitive lookup failed inside the module. The file server then treated the request as a file creation, checking only the caller's permission to add a file to
the parent directory and skipping the access check on the existing object. The subsequent open then collided with, and re-opened, the existing object.

As a result an authenticated user could read or overwrite files owned by another user, despite those files having restrictive permissions.