CVE-2026-109166

{
  "etk_id": "ETK-2026-1367",
  "cve_id": "CVE-2026-109166",
  "display_id": "CVE-2026-109166",
  "ghsa_id": "GHSA-xv2w-mrmf-rf3c",
  "euvd_id": "EUVD-2026-97372",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authenticated IDOR in lamp-cloud file URL retrieval",
  "summary": "lamp-cloud through 5.10.1 does not enforce ownership checks when retrieving storage URLs for uploaded files. An authenticated attacker who knows or can supply another user's file identifier may obtain an access URL and read that user's attachments.",
  "mitigation": "Upgrade to a vendor release that adds ownership authorization checks when one is available. Until then, restrict access to affected file URL retrieval functionality and enforce server-side ownership checks before returning storage URLs.",
  "vendor": "dromara",
  "product": "lamp-cloud",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 5.10.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "lamp-cloud",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0024,
  "epss_percentile": 0.1397,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 57.96289835,
  "t0_at": "2026-10-12T13:10:31.628000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T15:27:35.982222+00:00",
      "days": 0.09518928497685185,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T13:10:31.628000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-10-12T13:10:31.628000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T13:10:31.628000+00:00",
      "url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/lamp-cloud/poc_findUrlById_url.py"
    },
    "trigger_signal": {
      "at": "2026-10-12T13:10:31.628000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T13:10:31.628000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109166"
    }
  }
}