Threats tagged 'ghsa-75cj-c67p-vvgx'

lamp-cloud versions up to 5.10.0 contain an authorization bypass vulnerability in the FileAnyoneController component. Authenticated users can download arbitrary attachments belonging to other users by supplying valid attachment IDs to specific endpoints, due to lack of ownership validation. This vulnerability allows unauthorized access to stored files without requiring elevated privileges.