CVE-2026-109168 in lamp-cloud
Summary
by MITRE • 10/12/2026
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and stored URLs, which in default LOCAL storage are served without login under /anyTenant/file.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified within lamp-cloud versions up to 5.10.1 represents a classic instance of an insecure direct object reference, commonly categorized under CWE-639. This flaw resides specifically in the listFileByBizId endpoint, which is designed to retrieve file attachments associated with specific business objects. The core technical deficiency lies in the application's failure to perform adequate authorization checks on the bizId parameter supplied by the client. Instead of verifying that the authenticated user requesting the files has legitimate ownership or administrative privileges over the specified business object, the system blindly trusts the input identifier and proceeds to fetch metadata for any file attachment linked to that ID. This lack of access control enforcement allows an attacker who possesses valid authentication credentials for a low-privilege account to enumerate resources belonging to other tenants or users within the same instance.
From an operational perspective, this vulnerability facilitates significant information disclosure with potentially severe downstream consequences. By exploiting this flaw, attackers can retrieve critical metadata including file names, storage paths, MD5 hashes, and direct URLs where files are hosted. The impact is exacerbated by the default configuration of the LOCAL storage backend in lamp-cloud. In this setup, static assets such as uploaded documents are served directly via a public path, specifically /anyTenant/file, without requiring additional authentication or session validation for retrieval. Consequently, once an attacker obtains the direct URL from the metadata returned by the vulnerable endpoint, they can access and download sensitive business data simply by navigating to that link in a browser or using standard HTTP tools. This effectively bypasses the application's intended security boundaries, turning what should be private corporate documents into publicly accessible resources for any authenticated user who knows how to construct the appropriate request.
This attack vector aligns closely with MITRE ATT&CK techniques related to Discovery and Collection, specifically T1083 File and Directory Discovery and potentially T1530 Data from Cloud Storage Object if the storage backend were misconfigured or exposed externally. The ability to list files by arbitrary ID allows for systematic enumeration of an organization's data assets, which can be leveraged in subsequent phases of a cyber kill chain such as credential harvesting or further exploitation based on file contents. For organizations utilizing lamp-cloud, immediate remediation is required to mitigate this risk. The primary mitigation involves implementing strict object-level access control checks within the listFileByBizId endpoint logic. Developers must ensure that every request validates whether the authenticated user's identity matches the owner of the business object identified by bizId before returning any metadata. Additionally, reviewing storage configurations is advisable; while LOCAL storage serves files without login in default setups, restricting direct web server access to these directories or enforcing authentication at the web server level can provide a defense-in-depth layer against unauthorized retrieval even if application-level checks are bypassed.