{"id":"CVE-2026-110108","summary":"MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API","details":"MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.","modified":"2026-10-15T07:07:24.809373080Z","published":"2026-10-13T16:53:09.830Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110108.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110108.json"},{"type":"ADVISORY","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/matecloud-storage-admin-missing-authz"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110108"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/matecloud-through-5.0.8-missing-authorization-via-api-v1-admin-storage-api"},{"type":"PACKAGE","url":"https://github.com/mateaix/matecloud"},{"type":"ARTICLE","url":"https://github.com/mateaix/matecloud/blob/57b1edc0f0b8b964448e2d41ef7ba98751e71d8d/mate-biz/mate-system/src/main/java/vip/mate/system/admin/trigger/controller/StorageController.java#L45-L118"},{"type":"ARTICLE","url":"https://github.com/mateaix/matecloud/blob/57b1edc0f0b8b964448e2d41ef7ba98751e71d8d/mate-gateway/src/main/resources/application.yml#L80-L85"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mateaix/matecloud","events":[{"introduced":"0"},{"fixed":"57b1edc0f0b8b964448e2d41ef7ba98751e71d8d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"5.0.8"},{"fixed":"5.0.8"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110108.json","vanir_signatures":[{"target":{"file":"mate-monolith/src/main/java/vip/mate/monolith/adapter/LocalUserQueryAdapter.java","function":"findByAccount"},"deprecated":false,"digest":{"function_hash":"310301892214531936138469982391957453846","length":366},"id":"CVE-2026-110108-1709e1a3","signature_type":"Function","signature_version":"v1","source":"https://github.com/mateaix/matecloud/commit/57b1edc0f0b8b964448e2d41ef7ba98751e71d8d"},{"deprecated":false,"digest":{"function_hash":"129473978292097692493641419330221706965","length":157},"id":"CVE-2026-110108-4419032f","signature_type":"Function","signature_version":"v1","source":"https://github.com/mateaix/matecloud/commit/57b1edc0f0b8b964448e2d41ef7ba98751e71d8d","target":{"file":"mate-monolith/src/main/java/vip/mate/monolith/adapter/LocalUserQueryAdapter.java","function":"findById"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["53792185854996112175246343740464883618","46723669866759775528606735749136472004","274141296804391336162771880176775021463","40348392360179567720005548118230331258","241586640293786955388039333151521900589","338652271627372000663755764545712281716","313648819178106651844608953682148946951","248285156638077007436241896918355511883","85078274143071399308716639028173877896","338470462733821882965757372981472048462","301826864320277942792945028050045103454","58254771257487795535981349028008273677","9505639316058477989342904051028480639","294997167091808459053374577174373719229","325754295493578340538857478939853413212","99288451114128321550715931159800646313","147159619315808775159721921526889384736","36367003732331354776616021479531082467","138924847988245068278936038512949454080","147839850713154274558770074794628176785","48057729296835607641198019267802390875","283248217798812559126295388845580795388","205525036788960156637351049351713102010","99288451114128321550715931159800646313","147159619315808775159721921526889384736","112648821232514276330252200596661764087"]},"id":"CVE-2026-110108-e230372a","signature_type":"Line","signature_version":"v1","source":"https://github.com/mateaix/matecloud/commit/57b1edc0f0b8b964448e2d41ef7ba98751e71d8d","target":{"file":"mate-monolith/src/main/java/vip/mate/monolith/adapter/LocalUserQueryAdapter.java"}}],"vanir_signatures_modified":"2026-10-15T07:07:24Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}