CVE-2026-94533 in lamp-cloud
Summary
by MITRE • 09/22/2026
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in lamp-cloud versions through 5.10.0 represents a critical failure in access control mechanisms within the FileAnyoneController component. This flaw is classified under CWE-284 Improper Access Control, specifically reflecting an authorization bypass where the application fails to enforce proper restrictions on authorized actions for specific users or roles. The core technical issue stems from the absence of ownership validation when processing requests to download files. When a user interacts with the endpoints /anyone/file/down and /anyone/file/download, the system accepts valid attachment identifiers but does not verify whether the requesting authenticated user is the actual owner of those resources as recorded in the created_by database column. This design oversight allows any authenticated account to retrieve arbitrary attachments by simply supplying different file IDs, effectively bypassing intended privacy boundaries between users.
From an operational perspective, this vulnerability enables unauthorized data exfiltration and violates the principle of least privilege. An attacker with valid credentials can enumerate or guess attachment identifiers to access sensitive documents belonging to other tenants or individuals within the system. This capability compromises confidentiality integrity across multi-tenant environments where lamp-cloud is deployed. The impact extends beyond simple file theft, as it may expose personally identifiable information, proprietary business data, or regulated content depending on what files are stored in the application. Such unauthorized access undermines trust in the platform and can lead to significant regulatory compliance issues if sensitive data is exposed without consent.
This type of vulnerability aligns with MITRE ATT&CK technique T1078 Valid Accounts, where adversaries leverage legitimate credentials to gain initial access or maintain persistence within a system. By exploiting this authorization bypass, an attacker does not need to compromise authentication mechanisms but rather abuses the logic flaws in resource-level permissions. The lack of server-side validation against the creator field means that even if session management is secure, data isolation between users remains broken. This highlights a common pitfall in web application development where frontend checks or implicit trust assumptions replace explicit backend authorization checks for every sensitive operation involving user-specific resources.
To mitigate this vulnerability, developers must implement strict ownership verification logic within the FileAnyoneController before serving any file content. The system should query the database to confirm that the authenticated session's user ID matches the created_by field associated with the requested attachment identifier. If there is no match, the request should be denied immediately with an appropriate error response rather than proceeding to serve the file data. Additionally, implementing robust input validation and ensuring that all API endpoints enforce consistent authorization policies across similar operations will help prevent similar flaws in other parts of the application. Regular security audits focusing on access control logic and automated testing for broken object level permissions are recommended to maintain long-term resilience against such attacks.