CVE-2026-114261: Missing Authentication in MomoTommy file-management-system

This vulnerability affects the MomoTommy file-management-system, specifically the Files API functions index, store, update, and destroy in app/Http/Controllers/FileController.php. Due to missing authentication checks on the Request argument, remote attackers can perform unauthorized actions on files. The product lacks versioning, preventing clear identification of affected releases. The issue was reported to the project early, but no vendor response or patch is available. An exploit has been publicly disclosed.

The vulnerability allows unauthenticated remote attackers to access and manipulate file management functions, potentially leading to unauthorized file operations. This could compromise the confidentiality and integrity of files managed by the system. The CVSS 4.0 score of 6.9 indicates a medium severity impact with network attack vector, no privileges required, and no user interaction needed.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should consider implementing external access controls or network restrictions to limit exposure until a vendor fix is released. Monitor vendor channels for updates and apply any future patches promptly. Due to the lack of versioning and vendor response, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.