CVE-2026-109166: Authorization Bypass Through User-Controlled Key in dromara lamp-cloud

The vulnerability exists in lamp-cloud versions up to 5.10.1 in the findUrlById handler of the FileAnyoneController. This handler fails to check whether the requesting user owns the file identified by the provided file ID, resulting in an insecure direct object reference (IDOR). An authenticated attacker can supply arbitrary file IDs belonging to other users to retrieve storage URLs and read files they should not have access to. This bypasses authorization controls and exposes potentially sensitive user data.

An attacker with valid authentication can access URLs for files owned by other users, leading to unauthorized disclosure of stored attachments. This compromises confidentiality of user data stored in lamp-cloud. There is no indication of privilege escalation or denial of service from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the findUrlById handler to only authorized users and consider additional access control checks at the application level to verify file ownership before returning URLs.