CVE-2026-109168: lamp-cloud Information Disclosure Flaw

CVE-2026-109168 Overview

CVE-2026-109168 is an insecure direct object reference (IDOR) vulnerability affecting lamp-cloud through version 5.10.1. The flaw resides in the listFileByBizId endpoint exposed by the AppendixController. Authenticated users can supply an arbitrary bizId to enumerate file attachments belonging to other business objects. The response discloses file names, storage paths, MD5 hashes, and stored URLs. In the default LOCAL storage configuration, those URLs are served without authentication under /anyTenant/file, allowing attackers to download the referenced files directly. The weakness is classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated tenant user can enumerate and download file attachments owned by other tenants or business objects, resulting in cross-tenant data exposure.

Affected Products

lamp-cloud (dromara) versions through 5.10.1
Deployments using the default LOCAL file storage backend
Multi-tenant installations exposing the AppendixController endpoint

Discovery Timeline

2026-10-12 - CVE-2026-109168 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109168

Vulnerability Analysis

The vulnerability exists in the listFileByBizId method within AppendixController.java of the lamp-base module. The endpoint accepts a bizId parameter from the request and returns the list of file attachments associated with that identifier. The controller performs no ownership or tenant-scope check against the authenticated principal before returning the result set. An attacker who holds any valid session can iterate over bizId values and harvest attachment metadata belonging to unrelated business records. The returned payload includes storage paths and URLs, which are directly resolvable when the application uses the default LOCAL storage mode.

Root Cause

The root cause is missing authorization logic on a user-controlled key [CWE-639]. The controller trusts the bizId supplied by the client and treats it as an authoritative scoping value. There is no join against the current user's tenant, role, or object ownership. Compounding the issue, the /anyTenant/file route serves stored files without requiring an authenticated session, so disclosed storage paths translate directly into file downloads.

Attack Vector

Exploitation requires only low-privileged authenticated access to the application. The attacker sends an HTTP request to the listFileByBizId endpoint with a chosen bizId. The server responds with attachment metadata for that identifier. The attacker then issues a second unauthenticated request to the disclosed /anyTenant/file URL to retrieve the file contents. A public proof-of-concept script is available in the GitHub PoC Repository and the vulnerable controller code can be reviewed in the GitHub Lamp-Cloud Controller Code.

// No verified sanitized exploit snippet published; see the linked PoC and controller source for technical detail.

Detection Methods for CVE-2026-109168

Indicators of Compromise

Repeated authenticated requests to the listFileByBizId endpoint with sequentially varied bizId parameters from a single session or IP address.
Unauthenticated GET requests to /anyTenant/file/* paths originating from the same client that previously enumerated bizId values.
Access-log entries showing high-volume attachment metadata retrieval disproportionate to the user's business scope.

Detection Strategies

Baseline normal usage of the AppendixController endpoints and alert on access patterns that exceed per-user thresholds.
Correlate application-layer logs between the metadata endpoint and the /anyTenant/file download route to identify enumeration-then-download sequences.
Deploy web application firewall (WAF) rules that inspect bizId parameter values for brute-force or incrementing patterns.

Monitoring Recommendations

Enable verbose audit logging on the lamp-cloud lamp-base module, capturing authenticated principal, tenant ID, and requested bizId.
Forward application and web-tier logs to a centralized analytics platform for cross-tenant access correlation.
Monitor outbound bandwidth associated with the /anyTenant/file route and flag anomalous spikes.

How to Mitigate CVE-2026-109168

Immediate Actions Required

Restrict network exposure of the lamp-cloud application to trusted users while a patched release is evaluated.
Review authentication and session controls to ensure that only required business roles can reach the listFileByBizId endpoint.
Audit recent access logs for signs of bizId enumeration against the AppendixController.

Patch Information

No vendor-supplied patch is referenced in the available advisory data at publication time. Consult the VulnCheck Security Advisory and the lamp-cloud project repository for upstream fixes. Operators should track the dromara/lamp-cloud repository for a release above 5.10.1 that introduces authorization checks on the listFileByBizId method.

Workarounds

Add a server-side authorization check that validates the authenticated user's tenant and ownership of the requested bizId before returning attachment data.
Replace the default LOCAL storage mode with an object storage backend that enforces signed, time-limited URLs rather than public paths under /anyTenant/file.
Place a reverse proxy or WAF rule in front of the /anyTenant/file route to require an authenticated session cookie.

bash

# Example nginx rule to require authentication on the file-serving route
location /anyTenant/file/ {
    auth_request /auth/validate;
    proxy_pass http://lamp_cloud_upstream;
}