MateCloud EUVD-2026-98941

Requires a valid authenticated MateCloud account at any privilege level; the description explicitly notes low-privilege or self-registered users suffice, so where open/self-registration is enabled the practical barrier is near zero. The core condition is the gateway misconfiguration (mate-gateway application.yml) that leaves the /api/v1/admin/storage routes in StorageController without an authorization check, allowing arbitrary bucket and objectName parameters. Limiting factors: an account is still needed (PR:L), so environments that disable self-registration and tightly control account issuance force the attacker to first obtain credentials; impact is also bounded to the configured object-storage backend. No user interaction and no special client-side configuration are required.

This is a genuine prioritization concern, not an inflated high-CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H) describes a remote, network-reachable, low-complexity flaw requiring only a low-privilege authenticated account with no user interaction - and the description confirms that account can be self-registered, which effectively collapses the PR:L barrier to near-zero wherever open registration is enabled. The missing-authorization root cause (CWE-862) on /api/v1/admin/storage yields both high confidentiality impact (pre-signed download URLs for other users' files) and high integrity impact (arbitrary delete and upload-at-chosen-key), so the dual VC:H/VI:H rating is well supported by the described capabilities. Signals that would normally escalate urgency are absent or unknown: there is no CISA KEV listing and no explicit POC/exploit flag in the provided data, and no EPSS score was supplied, so widespread or automated exploitation cannot be asserted. A detailed technical write-up (hackmd) and a VulnCheck advisory exist, which materially lowers the effort for an attacker to reproduce the issue even though no weaponized exploit is confirmed. Net: real priority for any organization running MateCloud with self-registration, tempered by the product's limited deployment footprint and the lack of confirmed active exploitation.

An attacker self-registers or uses any low-privilege MateCloud account, then directly calls the unprotected /api/v1/admin/storage endpoints in StorageController, supplying arbitrary bucket and objectName values. They enumerate and obtain pre-signed download URLs for other tenants' objects to exfiltrate sensitive files, and can delete or overwrite objects at attacker-chosen keys. No public weaponized exploit is confirmed in the provided data, but a step-by-step technical write-up and vendor advisory are referenced, making reproduction straightforward.