lamp‑cloud versions up to 5.10.1 contain an insecure direct object reference that allows any authenticated user to retrieve the storage URL of files owned by other users. By sending arbitrary file ids to the /anyone/file/findUrlById endpoint, a user can obtain download links and read attachments belonging to other users, leading to data disclosure. The flaw is a classic example of CWE‑639: Improper Restriction of Operations within the Bounds of a Resource.

The vulnerability affects the dromara lamp‑cloud product, specifically all releases through version 5.10.1. No further sub‑component or platform qualifiers are listed. Updating to a version later than 5.10.1 is likely required to remediate the issue.

The CVSS score of 7.1 indicates a high severity level. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the exploitation probability cannot be precisely quantified, but the lack of public exploitation data does not reduce the risk inherent in an IDOR. The attack vector is remote, HTTP based, and requires the attacker to be authenticated to the application. Once authenticated, the attacker can send a crafted request with any file id, bypassing ownership checks, and retrieve URLs that provide direct access to the underlying storage. The vulnerability is exploitable without special privileges beyond legitimate user credentials, making it a practical risk for any environment where user accounts exist.