MateCloud versions up to 5.0.8 expose the /api/v1/admin/storage endpoints without proper authorization checks. The flaw allows any authenticated user, even those with low privileges or self‑registered accounts, to manipulate the object storage service. Affected users can supply arbitrary bucket and objectName parameters to list contents, generate pre‑signed URLs for other users’ files, delete objects, or upload files under chosen keys, effectively compromising confidentiality, integrity, and availability of stored data. The weakness is a classic missing authorization failure (CWE‑862).

The vulnerability affects the MateCloud platform from the vendor MateAix, specifically all releases up to and including version 5.0.8. Users running any of these builds are at risk.

The CVSS score of 8.6 indicates high severity, while the EPSS score is not reported, implying no publicly available exploitation data at the time of this analysis. The flaw is not listed in the CISA KEV catalog. The attack requires only authenticated access, which is likely available to many users. An attacker could exploit the API directly after logging in, making the vulnerability easily exploitable in environments with any user accounts. Given the lack of an external exploit, the risk is primarily due to internal threat actors or compromised accounts. Prompt mitigation is recommended to prevent unauthorized data manipulation.