Description

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-21T22:17:00.173Z",
  "pubdate": "2026-09-21T22:17:00.173Z",
  "executiveSummary": "The lamp-cloud platform, specifically versions through 5.10.0, contains a critical authorization bypass vulnerability within the FileAnyoneController component.\nThis vulnerability is classified as an Insecure Direct Object Reference (IDOR), enabling authenticated users to access and download files belonging to other users without proper authorization.\nThe root cause stems from a failure to validate file ownership against the record's created_by metadata during file retrieval requests.\nBy manipulating attachment identifiers, an attacker can bypass access control mechanisms to retrieve arbitrary sensitive files stored within the system.\nThe risk implication is high, as it facilitates unauthorized data exfiltration and violates the principle of least privilege.\nExploitation requires an authenticated session; however, the vulnerability does not require administrative privileges, as any valid user can target files belonging to any other user in the environment.\nSuccessful exploitation results in the unauthorized disclosure of potentially sensitive information stored within the platform's attachment repository.",
  "technicalDetails": "The vulnerability resides in the FileAnyoneController component, specifically affecting the /anyone/file/down and /anyone/file/download API endpoints.\nThe flaw manifests as an authorization bypass where the application logic fails to perform a server-side verification of user permissions regarding the requested file resource.\nThe underlying database schema utilizes a created_by column to associate file records with their respective owners, but the application code neglects to cross-reference this field against the authenticated session's user identity during the file retrieval process.\nThe attack flow proceeds as follows: First, an authenticated attacker identifies the target attachment ID, often discoverable via enumeration or application interface interactions. Second, the attacker crafts a GET request to either the /anyone/file/down or /anyone/file/download endpoint, passing the target file ID as a parameter. Third, the FileAnyoneController processes the request without validating whether the current user matches the created_by identifier assigned to that specific file record.\nBecause the controller lacks an ownership check, it proceeds to locate the file on the server's storage backend and streams the content back to the requester. This mechanism allows any authenticated user to systematically iterate through attachment IDs and download files across the entire platform, effectively bypassing global privacy boundaries.\nThe technical failure is attributed to improper implementation of access control checks at the application layer. The system relies entirely on the client-supplied attachment identifier without enforcing authorization logic that would normally restrict the scope of accessible objects to those owned by the requestor.\nThis vulnerability is present in lamp-cloud versions through 5.10.0. The exploit is executed over the network and does not require elevated privileges; any valid user account is sufficient to leverage this authorization bypass. Post-exploitation, an attacker can harvest all stored attachments, leading to full confidentiality compromise of user-uploaded data."
}