CVE-2026-94533

Received Received - Intake

Authorization Bypass in lamp-cloud Allows File Download

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulnCheck

Description

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-94533

EUVD

EUVD-2026-84207

Affected Vendors & Products

Vendor	Product	Version / Range
lamp-cloud	lamp-cloud	From 5.10.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

lamp-cloud through version 5.10.0 has an authorization bypass flaw in the FileAnyoneController component. Authenticated users can exploit this to download files they do not own by providing valid attachment IDs to specific endpoints. The application fails to check if the requested file belongs to the user, allowing access to arbitrary attachments.

Detection Guidance

Check for unauthorized access to the /anyone/file/down and /anyone/file/download endpoints by reviewing server logs for suspicious download requests. Monitor file access patterns and verify if users are accessing files they did not create.

Impact Analysis

If you use lamp-cloud, attackers with valid credentials could access sensitive files belonging to other users. This includes confidential documents, personal data, or proprietary information stored as attachments. The impact depends on the sensitivity of the exposed files.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Apply patches or updates to the lamp-cloud software to fix the authorization bypass. Restrict access to the vulnerable endpoints by implementing proper authentication and authorization checks. Review and remove any unauthorized file access permissions.

Hi! I’m here to help you understand CVE-2026-94533. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70