EUVD-2026-97374
GHSA-57fx-f2v4-5cch
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitEnumerate arbitrary bizId values on listFileByBizId
-
ExecutionHarvest file paths, URLs and MD5 hashes
-
ImpactDownload other tenants' files via /anyTenant/file without login
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated account of any privilege level (PR:L) that can reach the listFileByBizId endpoint of lamp-cloud's AppendixController; the attacker then supplies an arbitrary bizId belonging to another business object/tenant. Full unauthenticated retrieval of the referenced files is specifically enabled by the DEFAULT LOCAL storage mode, where attachments are served without login under /anyTenant/file. Limiting factors: an authenticated session is mandatory (no fully anonymous exploitation of the listing endpoint), impact is confined to confidentiality (file metadata and, under LOCAL storage, file contents), and deployments using non-LOCAL storage backends may not expose files without authentication, reducing the download impact. |
| Impact | This is a genuine but moderate-priority access-control (IDOR, CWE-639) issue rather than a critical remote-code-execution threat. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent: network-reachable, low attack complexity, requires low-privilege authentication (PR:L), no user interaction, and confidentiality-only impact (VC:H, no integrity or availability). Signals largely agree: a public POC exists (increasing practical exploitability for any authenticated attacker), but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation. The score of 7.1 is driven purely by confidentiality exposure. Net: real and easy to exploit for anyone with a valid account, but bounded by the authentication requirement and the lack of integrity/availability impact and lack of in-the-wild exploitation evidence. EPSS data is missing, so exploitation-probability cannot be quantified from the input. |
| Exploit ScenarioDerived | An attacker who holds any valid low-privilege account on a lamp-cloud deployment calls the listFileByBizId endpoint while substituting arbitrary bizId values belonging to other business objects or tenants, receiving back file names, storage paths, MD5 hashes and stored URLs. In the default LOCAL storage mode those URLs under /anyTenant/file are served without any login, so the attacker then downloads other tenants' files directly. A public POC (poc_listByBizId_attachment.py) demonstrating this is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Insecure direct object reference in lamp-cloud through 5.10.1 lets any authenticated user, regardless of privilege level, list and retrieve file attachments that belong to other business objects or tenants by supplying an arbitrary bizId to the listFileByBizId endpoint exposed by AppendixController. The response leaks file names, storage paths, MD5 hashes and stored URLs, and because the default LOCAL storage mode serves those attachments without login under /anyTenant/file, the referenced file contents themselves can be downloaded anonymously once the metadata has been harvested. Publicly available exploit code exists, but the impact is confined to confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), making this a genuine but moderate-priority access-control issue rather than a critical remote-code-execution threat.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, and the GitHub reference points at the vulnerable source rather than a fix, so remediation must be driven by compensating controls until an official update is published; monitor the vendor advisory at https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.1-idor-via-anyone-appendix-listfilebybizid for a patched release. The most effective immediate mitigation is to stop relying on the client-supplied bizId: add a server-side authorization check in AppendixController.listFileByBizId (or an interceptor/filter) that resolves the caller's tenant and business scope from the authenticated context and rejects any bizId outside it, returning 403 rather than an empty list so abuse is detectable - this requires a code change and regression testing of legitimate cross-module file listings. Independently, block or authenticate /anyTenant/file at the reverse proxy or API gateway so that LOCAL-mode attachments cannot be fetched anonymously, accepting that any legitimate anonymous-sharing feature in the product will break. Where deployments can do so, switch the storage mode away from LOCAL to an authenticated object-store backend (MinIO/S3-compatible with signed, time-limited URLs), which limits this bug to metadata disclosure; the trade-off is an added infrastructure dependency and per-download URL signing. Finally, restrict network reachability of the affected API to trusted networks or SSO-fronted users, rate-limit and alert on repeated listFileByBizId calls with varying bizId values (a strong enumeration signature), and treat the leaked file names, MD5 hashes and paths as a data-exposure event for notification purposes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
lamp-cloud is a Java/Spring Cloud rapid-development platform (dromara project) whose lamp-base-controller module exposes AppendixController; lines 55-60 of that controller implement listFileByBizId, which takes a client-supplied bizId and returns attachment records without validating that the key belongs to the requesting user's tenant or business object. This is the classic CWE-639 Authorization Bypass Through User-Controlled Key (IDOR): the application trusts a user-controlled identifier instead of deriving the authorization scope from the authenticated session, so any valid account can pivot across tenants simply by iterating identifiers. The leaked record set is rich - file names, storage paths, MD5 hashes and stored URLs - which is useful both for mapping other tenants' data and for locating the underlying objects. The confidentiality impact is amplified by the platform's storage abstraction: in the DEFAULT LOCAL storage mode the files are exposed through /anyTenant/file with no login requirement, so metadata disclosure converts directly into unauthenticated file download, whereas deployments configured with a remote/authenticated storage backend (for example MinIO or an S3-compatible object store using signed URLs) generally require their own credentials and reduce the exposure to metadata only. The supplied CVSS:4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:N/VA:N) confirms a network-reachable, authentication-required, confidentiality-only weakness, and our independent assessment agrees.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint needs only a low-privilege account (PR:L) and no interaction; IDOR exposes other tenants' file data (C:H) with no integrity or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and stored URLs, which in default LOCAL storage are served without login under /anyTenant/file.
Technical POC Analysis
CWE-639, Authorization Bypass Through User-Controlled Key (IDOR).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A multi-tenant file-access flaw in lamp-cloud (through version 5.10.1) lets any authenticated user list and download file attachments belonging to other business objects and tenants, exposing document names, storage paths, hashes and the files themselves. Because the default LOCAL storage mode serves those attachments without a login, exposure can reach beyond the platform's user base to anyone who obtains a harvested URL. Leadership should treat this as a cross-tenant confidentiality breach risk that directly tests customer data-isolation commitments and related contractual and regulatory obligations.
No vendor-released patch identified at time of analysis. Interim mitigations: block or require authorization for the listFileByBizId endpoint at the reverse proxy/WAF, deny anonymous access to /anyTenant/file, move storage off LOCAL mode to a mode that enforces authenticated retrieval, enforce object-level and tenant authorization in AppendixController, rotate exposed file identifiers and URLs, and monitor for bizId enumeration patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB