EUVD-2026-84207

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and...

CVE-2026-94533 lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and...

CVE-2026-94533

lamp-cloud through version 5.10.0 is affected by an authorization bypass in the FileAnyoneController . The /anyone/file/down and /anyone/file/download endpoints never validate file ownership against the created_by column, allowing any authenticated user to retrieve attachments belonging to other ...

CVE-2026-94533 lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and...

PT-2026-96307

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1 Description An authorization bypass exists in the FileAnyoneController that allows authenticated users to download arbitrary attachments. By providing valid attachment identifiers to the '/anyone/file/down'...

CVE-2026-94533: Authorization Bypass Through User-Controlled Key

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and...