This vulnerability is a classic IDOR (CWE-639) that allows an authenticated user to retrieve attachment metadata for any business object by supplying an arbitrary bizId to the /anyone/appendix/listFileByBizId endpoint. An attacker can enumerate file names, storage paths, MD5 hashes and stored URLs, and in the default LOCAL storage configuration the files are served publicly under "/anyTenant/file" without requiring authentication. The result is a breach of confidentiality and potential exposure of sensitive business documents.

The affected product is lamp‑cloud by dromara. Versions through 5.10.1 contain the flaw. No other product or version specificity is provided in the CNA data. Users deploying lamp‑cloud 5.10.1 or earlier are at risk.

The assessed CVSS score is 7.1, indicating a high severity vulnerability. EPSS information is not provided, so the current exploitation probability cannot be determined. The vulnerability is not listed in the CISA KEV catalog. Attackers with valid credentials can exercise the IDOR directly via the exposed endpoint; no privileged escalation is required. The failure to enforce ownership checks on the business object identifier makes the flaw easy to exploit in a legitimate user session.