CVE-2026-109166: lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById

Q: Who can exploit this issue?

Any authenticated lamp-cloud user can exploit it. The attacker only needs to submit file IDs belonging to other users to the affected handler.

Q: What information can an attacker obtain?

The vulnerable handler returns storage access URLs for files owned by other users. Those URLs can be used to read uploaded attachments.

Q: Are unauthenticated attackers affected?

The available information describes exploitation by authenticated users only. It does not establish that unauthenticated access is possible.

Published Oct 12, 2026

Updated

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which never checks ownership, to retrieve access URLs and read uploaded attachments.

Affected Software

1 affected component

lamp-cloud lamp-cloud<=5.10.1

Event History

Oct 12, 2026

CVE Published

via MITRE·01:10 PM

Data Sourced

via MITRE·01:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated lamp-cloud user can exploit it. The attacker only needs to submit file IDs belonging to other users to the affected handler.

What information can an attacker obtain?

The vulnerable handler returns storage access URLs for files owned by other users. Those URLs can be used to read uploaded attachments.

Are unauthenticated attackers affected?

The available information describes exploitation by authenticated users only. It does not establish that unauthenticated access is possible.

CVE-2026-109166: lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

Are unauthenticated attackers affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

Are unauthenticated attackers affected?