lamp-cloud CVE-2026-109166

Requires a valid low-privilege authenticated session on the lamp-cloud application (PR:L) - it is NOT remote-unauthenticated. Given a session, the attacker calls the findUrlById handler of FileAnyoneController and supplies file ids owned by other users; the handler returns storage access URLs without any ownership/authorization check (CWE-639). Limiting factors: the attacker must obtain or register an account, and must know or enumerate valid file ids belonging to victims (ids appear to be user-controllable, which eases enumeration). No special non-default configuration or user interaction is required, and impact is confined to reading uploaded attachments (confidentiality only); affected deployments are those running lamp-cloud at or below version 5.10.1.

This is a genuine but bounded access-control issue rather than a top-tier emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity flaw requiring low-privilege authentication (PR:L), with high confidentiality impact and no integrity or availability impact - consistent with CWE-639 (IDOR / authorization bypass through user-controlled key) and the description. Public exploit code exists (a Python PoC for the findUrlById endpoint), which raises practical exploitability for any party with a valid low-privilege account, but there is NO CISA KEV listing and NO EPSS score was provided in the input, so widespread or automated exploitation cannot be confirmed from the data. SSVC-style reading: exploitation = PoC available (not 'active'); technical impact = partial (confidentiality-only); automatable = likely (file ids can be enumerated and the handler performs no ownership check), but exposure is limited to deployments of a niche platform. Net: a real, confirmed-fixable confidentiality priority for anyone running lamp-cloud, but not a mass-exploitation threat on the available evidence. Note the single data signal to verify: the input Tag labels this 'Authentication Bypass', whereas the description and CWE-639 make clear it is an authorization/IDOR flaw affecting already-authenticated users - treat the tag as mislabeled.

An attacker who already holds any low-privilege authenticated account on a lamp-cloud instance sends requests to the findUrlById handler of FileAnyoneController supplying file ids belonging to other users. Because the handler never verifies ownership, it returns storage access URLs that the attacker uses to download other users' uploaded attachments. A public Python PoC (poc_findUrlById_url.py) demonstrates this end to end.