CVE-2026-94533 Overview
CVE-2026-94533 is an authorization bypass vulnerability in lamp-cloud versions through 5.10.0. The flaw resides in the FileAnyoneController class, which exposes the /anyone/file/down and /anyone/file/download endpoints. Authenticated users can supply any valid attachment identifier and receive the associated file, because the controller never validates the requesting user against the created_by column on the attachment record. The issue is classified as an Insecure Direct Object Reference (IDOR) under [CWE-639]. Attackers with any low-privileged account can enumerate identifiers and exfiltrate documents uploaded by other tenants or users.
Critical Impact
Any authenticated lamp-cloud user can download arbitrary attachments belonging to other users by iterating attachment IDs against the file download endpoints.
Affected Products
- lamp-cloud (dromara/lamp-cloud) versions through 5.10.0
- FileAnyoneController component in lamp-base-controller
- Deployments exposing /anyone/file/down and /anyone/file/download endpoints
Discovery Timeline
- 2026-09-21 - CVE-2026-94533 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-94533
Vulnerability Analysis
The vulnerability is a broken object-level authorization flaw (BOLA) in the lamp-cloud microservice framework. The FileAnyoneController handles unrestricted file retrieval for authenticated users through two endpoints: /anyone/file/down and /anyone/file/download. Both handlers accept an attachment identifier as input and return the referenced file content. The controller performs authentication but omits ownership verification. As a result, the created_by column stored alongside each attachment is never compared against the current session principal.
An authenticated attacker with a valid account can iterate integer or UUID identifiers and retrieve any stored attachment. In multi-tenant lamp-cloud deployments, this enables cross-tenant data disclosure of documents that should remain scoped to their uploader or organization.
Root Cause
The root cause is a missing authorization check on the resource lookup path. The download handlers resolve the attachment record by its primary key and stream its bytes without joining or filtering by the current user identity. This aligns directly with [CWE-639] Authorization Bypass Through User-Controlled Key. See the GitHub File Controller Code for the affected lines.
Attack Vector
Exploitation requires only low-privileged authenticated access over the network. An attacker logs in with any valid credentials, then issues HTTP requests to /anyone/file/down or /anyone/file/download supplying sequential or guessed attachment identifiers. The server returns each file irrespective of the caller's ownership. A public proof of concept demonstrating the attack is published in the GitHub PoC Repository. Additional context is available in the VulnCheck Security Advisory.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-94533
Indicators of Compromise
- Sequential or high-volume GET requests to /anyone/file/down or /anyone/file/download from a single authenticated session.
- Attachment identifiers in access logs that do not correspond to files uploaded by the requesting user account.
- Large outbound data transfers originating from the lamp-cloud file service tied to a single user token.
Detection Strategies
- Correlate application access logs with the attachment ownership table to flag downloads where the requester differs from the created_by value.
- Deploy web application firewall (WAF) rules that rate-limit and alert on rapid enumeration of the two vulnerable endpoints.
- Baseline normal per-user download volumes and alert on statistical deviations.
Monitoring Recommendations
- Forward lamp-cloud application, gateway, and WAF logs into a centralized analytics platform for cross-source correlation.
- Monitor authentication events for newly created low-privileged accounts that immediately access the file download endpoints.
- Track file-service response sizes to identify bulk exfiltration patterns even when individual requests appear valid.
How to Mitigate CVE-2026-94533
Immediate Actions Required
- Restrict network access to /anyone/file/down and /anyone/file/download at the ingress or API gateway until a patched build is deployed.
- Review audit logs for anomalous download activity dating back to the initial deployment of lamp-cloud 5.x.
- Rotate or revoke sessions for any account observed enumerating attachment identifiers.
Patch Information
No fixed version has been published in the NVD entry at the time of writing. Track the upstream GitHub Lamp Cloud Project for a corrected release that adds an ownership check comparing the authenticated principal against the created_by column before returning file content. Apply the vendor patch across all lamp-cloud nodes as soon as it becomes available.
Workarounds
- Add a reverse-proxy authorization layer that validates the attachment identifier against the caller's user or tenant scope before proxying to the file service.
- Temporarily disable the FileAnyoneController endpoints if the download workflow is not required for business operations.
- Enforce short-lived, signed download URLs generated only after server-side ownership validation, rather than exposing raw attachment IDs to clients.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
