CVE-2026-94533 is an authorization bypass vulnerability in dromara lamp-cloud through version 5.10.0. The issue exists in the FileAnyoneController where the application fails to verify that the requesting user owns the file identified by the attachment ID. As a result, any authenticated user can access and download arbitrary attachments belonging to other users by calling the /anyone/file/down and /anyone/file/download endpoints with valid attachment identifiers. This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with valid authentication can bypass authorization controls to download files stored by other users. This leads to unauthorized disclosure of potentially sensitive information. The vulnerability does not affect integrity or availability but impacts confidentiality with a medium severity rating (CVSS 6.5). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints or implement additional access control checks to verify file ownership before allowing downloads.