CVE-2026-110108: MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API
Published Oct 13, 2026
·Updated
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.
Affected Software
1 affected component
MateCloud MateCloud<=5.0.8
Event History
Oct 13, 2026
CVE Published
via MITRE·04:53 PM
Data Sourced
via MITRE·04:53 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness