Description
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.
Published: 2026-09-21
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Unauthorized File Access
Action: Apply Patch
AI Analysis

Impact

lamp‑cloud versions up to 5.10.0 contain a flaw in the FileAnyoneController that bypasses file‑ownership checks. An authenticated user can request any file by supplying its attachment identifier to the /anyone/file/down or /anyone/file/download endpoints, and the application does not compare that identifier against the creator or owner of the file. This allows a user to read other users’ private uploads, leaking confidential data without needing any additional privileges.

Affected Systems

The vulnerability affects the dromara lamp‑cloud product, specifically all releases through version 5.10.0. No sub‑versions or service packs are listed as unaffected.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity vulnerability that can be abused by any authenticated user within the system. Because the exploit simply requires a valid attachment ID and no elevation of privileges, the attack is easy to perform once the attacker has legitimate login credentials. EPSS data is unavailable, and the flaw is not listed in CISA KEV, but the impact of leaking sensitive files warrants careful attention.

Generated by OpenCVE AI on September 21, 2026 at 22:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade lamp‑cloud to a version that enforces file ownership checks, such as 5.10.1 or later.
  • If an immediate upgrade is not possible, restrict access to the /anyone/file/down and /anyone/file/download endpoints to users with explicit file‑access permissions, or disable them entirely.
  • After applying a fix, review and monitor file‑download logs for any unauthorized activity to ensure that the vulnerability has been fully mitigated.

Generated by OpenCVE AI on September 21, 2026 at 22:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Dromara
Dromara lamp-cloud
Vendors & Products Dromara
Dromara lamp-cloud

Mon, 21 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
Description lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.
Title lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file
First Time appeared Tangyh
Tangyh lamp-cloud
Weaknesses CWE-639
CPEs cpe:2.3:a:tangyh:lamp-cloud:*:*:*:*:*:*:*:*
Vendors & Products Tangyh
Tangyh lamp-cloud
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Dromara Lamp-cloud
Tangyh Lamp-cloud
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-21T21:28:12.305Z

Reserved: 2026-09-21T18:25:17.934Z

Link: CVE-2026-94533

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T22:17:00.173

Modified: 2026-09-21T22:17:00.173

Link: CVE-2026-94533

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T23:00:10Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key