CVE-2026-109168: lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId

Q: Who can exploit this issue?

An attacker needs an authenticated lamp-cloud account with low privileges; no user interaction is required. The vulnerable endpoint is reachable over the network and accepts an arbitrary business object identifier.

Q: What information can be exposed?

The endpoint can disclose attachment metadata for other business objects, including file names, storage paths, MD5 hashes, and stored URLs. Where default LOCAL storage is used, the disclosed files are served without login under /anyTenant/file.

Q: Are default deployments affected?

Default LOCAL storage increases the impact because attachment URLs can be accessed without authentication under /anyTenant/file. The issue affects lamp-cloud through version 5.10.1.

Q: How can I check whether my deployment is exposed?

Using a low-privileged authenticated account, request /anyone/appendix/listFileByBizId with a bizId belonging to a different business object and check whether attachment metadata is returned. Also determine whether the returned stored URLs are accessible without login under /anyTenant/file.

Published Oct 12, 2026

Updated

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and stored URLs, which in default LOCAL storage are served without login under /anyTenant/file.

Affected Software

1 affected component

lamp-cloud<=5.10.1

Event History

Oct 12, 2026

CVE Published

via MITRE·01:10 PM

Data Sourced

via MITRE·01:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated lamp-cloud account with low privileges; no user interaction is required. The vulnerable endpoint is reachable over the network and accepts an arbitrary business object identifier.

What information can be exposed?

The endpoint can disclose attachment metadata for other business objects, including file names, storage paths, MD5 hashes, and stored URLs. Where default LOCAL storage is used, the disclosed files are served without login under /anyTenant/file.

Are default deployments affected?

Default LOCAL storage increases the impact because attachment URLs can be accessed without authentication under /anyTenant/file. The issue affects lamp-cloud through version 5.10.1.

How can I check whether my deployment is exposed?

Using a low-privileged authenticated account, request /anyone/appendix/listFileByBizId with a bizId belonging to a different business object and check whether attachment metadata is returned. Also determine whether the returned stored URLs are accessible without login under /anyTenant/file.

CVE-2026-109168: lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are default deployments affected?

How can I check whether my deployment is exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are default deployments affected?

How can I check whether my deployment is exposed?