CVE-2026-94533

lamp-cloud through version 5.10.0 is affected by an authorization bypass in the FileAnyoneController . The /anyone/file/down and /anyone/file/download endpoints never validate file ownership against the created_by column, allowing any authenticated user to retrieve attachments belonging to other ...