Threats tagged 'ghsa-8j2c-pwgm-76r5'

CVE-2026-108706 is a missing authorization vulnerability in elunez eladmin's downloadS3Storage handler. It allows any authenticated user to access stored object URLs without proper storage permissions by enumerating sequential IDs. This exposure can lead to unauthorized access to file contents stored in publicly readable buckets. The vulnerability has a medium severity with a CVSS score of 5.3. A patch is available, and the product is a cloud service, so vendor-managed remediation is expected.