CVE-2026-110108
Received Received - Intake

MateCloud Missing Authorization in Object Storage Management

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-110108
EUVD
EUVD-2026-98941

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mateaix MateCloud 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MateCloud through version 5.0.8 has a missing authorization vulnerability in StorageController. Authenticated users, even low-privilege or self-registered ones, can access unprotected /api/v1/admin/storage endpoints to manage object storage. They can list objects, generate pre-signed download URLs for other users' files, delete objects, and upload files to arbitrary locations.

Detection Guidance

Check for unauthorized access to /api/v1/admin/storage endpoints by reviewing web server logs for requests to these paths. Look for unusual activity from low-privilege or self-registered users attempting to list, delete, or upload objects with arbitrary bucket and objectName values.

Impact Analysis

An attacker with even basic access could steal sensitive files by generating download URLs, delete critical data causing service disruption, or upload malicious files to impersonate legitimate users. This could lead to data breaches, financial loss, or reputational damage.

Compliance Impact

This vulnerability likely violates GDPR's data protection requirements by enabling unauthorized access to personal data and HIPAA's integrity and confidentiality rules by allowing data tampering or theft. Organizations using MateCloud may face compliance violations, fines, or legal consequences.

Mitigation Strategies

Immediately update MateCloud to the latest version that patches this vulnerability. Restrict access to /api/v1/admin/storage endpoints by implementing proper authorization checks. Review and remove any unauthorized user accounts, especially those with low privileges that could exploit this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110108. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart