CVE-2026-109168: Authorization Bypass Through User-Controlled Key in dromara lamp-cloud

The vulnerability in lamp-cloud (<=5.10.1) is an insecure direct object reference that permits authenticated users to bypass authorization controls by manipulating the bizId parameter in the listFileByBizId API endpoint. This results in unauthorized access to metadata about files attached to other business objects. The exposed information includes file names, storage locations, MD5 hashes, and URLs. In default LOCAL storage configurations, these URLs serve files without requiring authentication, increasing the risk of unauthorized data exposure.

An attacker with valid authentication can enumerate and access file metadata and potentially the files themselves belonging to other business objects. This unauthorized disclosure of sensitive file information and access to files without login in default LOCAL storage configurations can lead to data leakage and privacy violations. The CVSS 4.0 score of 7.1 (high severity) reflects the network attack vector, low attack complexity, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the listFileByBizId endpoint to only authorized users and consider disabling or securing the default LOCAL storage file serving path (/anyTenant/file) to prevent unauthenticated access.