CVE-2026-108706: eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/{id} to collect URLs of all uploaded objects, exposing file contents on publicly readable buckets.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated eladmin user can exploit it; the attacker does not need S3 storage permissions. Exploitation involves requesting the download endpoint with sequential object IDs.
What data is exposed?
The vulnerable handler returns URLs for stored objects. If the referenced S3 bucket is publicly readable, those URLs can expose the contents of uploaded files.
Are deployments using non-public S3 buckets still affected?
Authenticated users may still be able to retrieve stored object URLs without authorization. The provided information specifically identifies file-content exposure when the bucket is publicly readable.
How can administrators check for attempted exploitation?
Review requests to GET /api/s3Storage/download/{id}, particularly patterns of sequential or repeated IDs from authenticated users. Such enumeration is the described method for collecting object URLs.