CVE-2026-109166: lamp-cloud IDOR Information Disclosure

CVE-2026-109166 Overview

CVE-2026-109166 is an insecure direct object reference (IDOR) vulnerability in lamp-cloud through version 5.10.1. The flaw resides in the findUrlById handler of FileAnyoneController, which returns storage URLs for file identifiers without verifying that the requesting user owns the referenced file. Authenticated users can enumerate or guess arbitrary file IDs belonging to other tenants and retrieve download URLs for their uploaded attachments. The weakness is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated lamp-cloud user can read other users' uploaded files by submitting arbitrary file IDs to the findUrlById endpoint, resulting in cross-tenant information disclosure.

Affected Products

lamp-cloud (dromara/lamp-cloud) all versions through 5.10.1
FileAnyoneController.findUrlById handler in lamp-base-controller
FileContext file-strategy component in lamp-base-biz

Discovery Timeline

2026-10-12 - CVE-2026-109166 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109166

Vulnerability Analysis

lamp-cloud exposes an anyone file controller intended to serve file metadata to any authenticated session. The findUrlById method accepts one or more file identifiers from the client and returns the backing object-storage URLs so the browser can download the attachment. The controller delegates to FileContext to resolve storage URLs but never checks whether the authenticated principal owns, uploaded, or has been granted access to the requested file.

Because file IDs are predictable integer or snowflake values, an attacker with any valid account can iterate across the ID space and recover download URLs for files uploaded by other users or tenants. The returned URLs are typically pre-signed or publicly reachable object-storage links, so possession of the URL is equivalent to possession of the file. Exploitation requires only low-privilege authenticated access and a single HTTP request per target identifier.

Root Cause

The root cause is missing authorization in the findUrlById handler of FileAnyoneController (lines 75-80) and in the FileContext resolution path (lines 147-170). Neither component correlates the submitted id parameter with the current session's user, tenant, or ACL. The design assumes the request itself is trusted once the user is authenticated, which is the classic IDOR pattern captured by CWE-639.

Attack Vector

An attacker authenticates to lamp-cloud using any valid credentials, including a self-registered or low-privileged tenant account. The attacker then issues HTTP requests to the findUrlById endpoint supplying file IDs belonging to other users. A proof-of-concept script that enumerates file IDs is published in the GitHub PoC repository. The server responds with the storage URL for each requested ID, which the attacker then fetches directly from object storage to exfiltrate the file contents. See the VulnCheck Security Advisory for additional detail.

Detection Methods for CVE-2026-109166

Indicators of Compromise

High-volume or sequential requests from a single authenticated session to the findUrlById endpoint of FileAnyoneController.
Access log entries where the resolved file owner differs from the requesting user's ID or tenant ID.
Outbound downloads from object storage to IP addresses or user agents that did not originate the matching upload.

Detection Strategies

Instrument the findUrlById handler to log the requesting user, requested file ID, and the file's owning user/tenant for every call, then alert on mismatches.
Baseline normal file-URL retrieval rates per user and alert on statistical outliers that suggest enumeration.
Correlate application access logs with object-storage access logs to flag downloads of files the authenticated user never uploaded.

Monitoring Recommendations

Monitor web server and reverse-proxy logs for repeated POST or GET requests to paths containing anyone/file/findUrlById with varying id parameters.
Monitor database or audit tables for cross-tenant file lookups and surface them to the SOC for review.
Retain application and storage access logs long enough to perform retrospective investigation if a disclosure is suspected.

How to Mitigate CVE-2026-109166

Immediate Actions Required

Restrict network exposure of lamp-cloud deployments running version 5.10.1 or earlier until a fix is applied.
Disable or front-proxy the FileAnyoneController.findUrlById endpoint and require per-request authorization checks.
Audit object-storage access logs for anomalous downloads referencing URLs issued through the vulnerable endpoint.

Patch Information

At the time of publication, no fixed release of lamp-cloud is referenced in the advisory. Operators should track the dromara/lamp-cloud repository for a security release that adds ownership and tenant validation to FileAnyoneController.findUrlById and to FileContext. Confirm remediation by reviewing the patched controller against the vulnerable FileAnyoneController source and FileContext source.

Workarounds

Add a reverse-proxy or web application firewall rule that blocks unauthenticated and low-privilege sessions from reaching findUrlById.
Introduce a server-side authorization filter that compares the requested file's owner and tenant to the session principal before returning any storage URL.
Replace predictable file identifiers with unguessable UUIDs and rotate existing identifiers for sensitive attachments to limit enumeration.

bash

# Example nginx rule to block the vulnerable endpoint until patched
location ~* /anyone/file/findUrlById {
    return 403;
}