CVE-2026-109166
Deferred Deferred - Pending Action

Insecure Direct Object Reference in lamp-cloud Exposes User File URLs

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which never checks ownership, to retrieve access URLs and read uploaded attachments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109166
EUVD
EUVD-2026-97372

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dromara lamp-cloud 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109166 is an Insecure Direct Object Reference (IDOR) vulnerability in lamp-cloud versions up to 5.10.1. It allows authenticated users to access other users' files by submitting arbitrary file IDs to the /anyone/file/findUrlById endpoint without proper ownership verification. The FileAnyoneController fails to check if the requested file belongs to the user, enabling unauthorized access to storage URLs and file content.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized POST requests to the /anyone/file/findUrlById endpoint. Check server logs for repeated requests with varying file IDs. Use tools like curl to test the endpoint manually: curl -X POST -H 'Content-Type: application/json' -d '{"fileIds":[123,456]}' http://target/lamp-cloud/anyone/file/findUrlById. If the endpoint returns URLs for files not owned by the requester, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to bypass authentication and authorization checks to access files belonging to other users. If exploited, attackers can retrieve storage URLs for any file ID and potentially download sensitive files, including uploaded attachments. The impact includes unauthorized data access, privacy breaches, and potential data theft.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA, which mandate strict access controls and protection of personal or sensitive data. Unauthorized access to user files could result in data breaches, leading to legal penalties, reputational damage, and loss of trust. Organizations must address this flaw to maintain regulatory compliance.

Mitigation Strategies

Immediately restrict access to the /anyone/file/findUrlById endpoint by requiring authentication and ownership verification. Update lamp-cloud to a version beyond 5.10.1. Implement strict input validation for file IDs and enforce tenant-based access controls in FileAnyoneController and FileContext. Review logs for past exploitation attempts and revoke any unauthorized access URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109166. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart