CVE-2026-109168

🗓️ 12 Oct 2026 13:10:32Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 23 Views🌐 WEB

Authenticated IDOR in lamp-cloud allows listing other business objects' file attachments.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2026-109168	12 Oct 202613:19	–	circl
Cvelist	CVE-2026-109168 lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId	12 Oct 202613:10	–	cvelist
EUVD	EUVD-2026-97374	12 Oct 202613:10	–	euvd
Mend	CVE-2026-109168	12 Oct 202613:10	–	mend
NVD	CVE-2026-109168	12 Oct 202613:17	–	nvd
Positive Technologies	PT-2026-110559	12 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-109168: Authorization Bypass Through User-Controlled Key	12 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-109168 lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId	12 Oct 202613:10	–	vulnrichment

Vulners

CNA

Node

tangyh lamp-cloudRange≤5.10.1

[
  {
    "vendor": "dromara",
    "product": "lamp-cloud",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "lessThanOrEqual": "5.10.1",
        "status": "affected",
        "versionType": "custom"
      }
    ],
    "packageURL": "pkg:github/dromara/lamp-cloud",
    "repo": "https://github.com/dromara/lamp-cloud"
  }
]

Source	Link
github	www.github.com/dromara/lamp-cloud/blob/d61184d7d402023fc3ea63b6bdbd7a1bfdb8ce92/lamp-base/lamp-base-controller/src/main/java/top/tangyh/lamp/file/controller/AppendixController.java
vulncheck	www.vulncheck.com/advisories/lamp-cloud-through-5.10.1-idor-via-anyone-appendix-listfilebybizid
github	www.github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/lamp-cloud/poc_listByBizId_attachment.py

Parameter	Position	Path	Description	CWE
bizId	path	/listFileByBizId	Insecure Direct Object Reference (IDOR) in the listFileByBizId endpoint allows authenticated users to list file attachments of other business objects by providing an arbitrary bizId.	CWE-639
file	path	/anyTenant/file	Files stored in LOCAL storage are served without authentication via this endpoint, potentially exposing sensitive data.	CWE-639

13 Oct 2026 19:18Current

6Medium risk

Vulners AI Score6

CVSS 3.16.5

CVSS 47.1

EPSS0.00231

SSVC

CWE-639