CVE-2026-109166 in lamp-cloud
Summary
by MITRE • 10/12/2026
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which never checks ownership, to retrieve access URLs and read uploaded attachments.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in lamp-cloud versions through 5.10.1 represents a classic case of insecure direct object reference, commonly categorized under CWE-639. This flaw arises from the application's failure to properly validate whether an authenticated user has legitimate ownership or authorization for the specific resource being accessed. In this scenario, the vulnerability is located within the FileAnyoneController component, specifically in its findUrlById handler. The core technical deficiency lies in the absence of any access control checks that verify if the requesting user ID matches the owner ID associated with the file identifier provided in the request payload. Consequently, the system treats all authenticated users as having equal privileges to retrieve metadata and temporary storage URLs for files stored within the cloud infrastructure, regardless of their actual relationship to those assets.
From an operational perspective, this vulnerability allows any authenticated account on the platform to enumerate and access private data belonging to other users. By supplying arbitrary file identifiers in HTTP requests directed at the vulnerable endpoint, attackers can bypass intended privacy controls and obtain direct URLs that grant read access to uploaded attachments. This capability effectively transforms a standard authentication requirement into a trivial barrier, as possession of valid credentials is sufficient to exploit the logic flaw without needing elevated privileges or additional exploitation vectors such as cross-site scripting or SQL injection. The impact extends beyond simple data leakage; it compromises the confidentiality and integrity expectations inherent in multi-tenant cloud storage environments where users rely on strict isolation between their private files and those of others.
This type of vulnerability aligns with several entries in the MITRE ATT&CK framework, particularly T1078 which covers Valid Accounts, as exploitation requires initial authentication but leverages poor authorization logic rather than credential theft. It also relates to T1530 Data from Cloud Storage Objects if an attacker proceeds to exfiltrate the retrieved files after obtaining their URLs. The severity of this issue is heightened by its simplicity and direct impact on data privacy compliance standards such as GDPR or HIPAA, depending on the nature of the stored attachments. Organizations running affected versions must recognize that standard authentication mechanisms are insufficient when underlying business logic fails to enforce object-level permissions.
To mitigate this vulnerability, immediate remediation involves patching lamp-cloud to version 5.10.2 or later where the issue has been addressed by implementing proper ownership verification within the findUrlById handler. Developers should ensure that every request for sensitive resources includes a validation step comparing the authenticated user's identity against the resource owner metadata before generating any access URLs. Additionally, adopting a principle of least privilege in API design and conducting regular security code reviews focused on authorization logic can prevent similar flaws from emerging in other parts of the application. Implementing automated testing that specifically targets broken object level permissions will further strengthen the defense posture against this class of vulnerabilities.