CVE-2026-109168
Deferred Deferred - Pending Action

Insecure Direct Object Reference in lamp-cloud Exposes File Attachments

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and stored URLs, which in default LOCAL storage are served without login under /anyTenant/file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109168
EUVD
EUVD-2026-97374

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dromara lamp-cloud 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109168 is an Insecure Direct Object Reference (IDOR) vulnerability in lamp-cloud versions up to 5.10.1. It allows authenticated users to access file attachments belonging to other business objects by providing an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and URLs without proper authorization checks.

Detection Guidance

To detect this vulnerability, check if your lamp-cloud instance exposes the /anyone/appendix/listFileByBizId or /anyone/appendix/listByBizId endpoints. Use tools like curl to send authenticated requests with arbitrary bizId values and verify if unauthorized file metadata or attachments are returned. Example: curl -X POST http://target/lamp-cloud/anyone/appendix/listFileByBizId -H 'Authorization: Bearer TOKEN' -d 'bizId=123'

Inspect network traffic for requests to /anyTenant/file serving files without authentication. Verify if file paths, names, or metadata are accessible without proper authorization checks.

Impact Analysis

This vulnerability enables attackers to access sensitive file attachments of other users or businesses. If files are stored locally, they may be served without authentication, exposing confidential data. Attackers could steal intellectual property, personal information, or other sensitive content through unauthorized file access.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by allowing unauthorized access to personal and sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized file access could lead to data breaches, resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade lamp-cloud to a version beyond 5.10.1 where this vulnerability is patched. If upgrading is not immediate, restrict access to the /anyone/appendix/listFileByBizId and /anyone/appendix/listByBizId endpoints via network policies or firewall rules.

Implement strict authorization checks in the AppendixController to verify ownership of bizId before returning file metadata. Ensure all file access requires valid authentication and proper tenant-level permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart