CVE-2026-110108 in MateCloud
Summary
by MITRE • 10/13/2026
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
MateCloud versions up through 5.0.8 exhibit a critical missing authorization vulnerability within its Object Storage management interface. This flaw resides in the StorageController component, specifically affecting endpoints exposed via /api/v1/admin/storage. The core technical deficiency is an absence of proper access control checks on these administrative API routes. While the endpoint requires authentication to prevent anonymous access, it fails to verify whether the authenticated user possesses the necessary privileges or role-based permissions to perform administrative actions such as managing object storage buckets and objects. Consequently, any individual who can successfully authenticate to the MateCloud platform, regardless of their assigned privilege level, is granted unrestricted control over the underlying object storage infrastructure.
The operational impact of this vulnerability is severe due to its potential for widespread data compromise and service disruption. Low-privilege users or self-registered accounts with minimal initial permissions can exploit this flaw by supplying arbitrary bucket names and object keys in their API requests. This capability allows attackers to enumerate objects within buckets they do not own, effectively leaking sensitive metadata and file listings from other tenants or internal systems. Furthermore, the vulnerability enables the generation of pre-signed download URLs for files belonging to other users. These time-limited but valid links can be shared externally, leading to unauthorized data exfiltration without needing direct access credentials for those specific files.
Beyond information disclosure, the lack of authorization extends to destructive and manipulative actions. Attackers with low privileges can delete objects from buckets they do not own, resulting in permanent data loss and denial of service for legitimate users who rely on that stored content. Additionally, the ability to upload files at chosen keys allows attackers to overwrite existing critical assets or inject malicious payloads into accessible storage locations. If these uploaded objects are subsequently served by a web server or accessed by other authenticated users, it could lead to cross-site scripting attacks, remote code execution via file inclusion vulnerabilities, or general integrity compromise of the application's data layer.
This vulnerability aligns with CWE-284, which describes Improper Access Control, and specifically maps to ATT&CK technique T1078, Valid Accounts, as it leverages legitimate but insufficiently privileged credentials to perform unauthorized administrative tasks. It also relates to CWE-639, Authorization Bypass Through User-Controlled Key, since the attacker controls the bucket and object parameters that determine what resources are accessed or modified. The root cause is a failure in implementing role-based access control (RBAC) checks at the API endpoint level for operations classified as administrative.
To mitigate this vulnerability, immediate remediation should focus on enforcing strict authorization policies within the StorageController logic. Developers must implement robust permission verification that ensures only users with explicit administrator or storage-management roles can invoke these endpoints. It is essential to validate not just authentication but also privilege levels before processing any request related to bucket management or object manipulation. Additionally, implementing input validation and sanitization for bucket names and object keys can help prevent certain types of path traversal attacks, although the primary fix must address the authorization gap. Regular security audits and penetration testing focusing on API access controls are recommended to identify similar gaps in other administrative interfaces within the MateCloud ecosystem.