Missing Authorization in MateCloud Object Storage Management
CVE-2026-110108

8.6HIGH

Key Information:

Vendor

Mateaix

Status
Matecloud
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110108?

MateCloud versions up to 5.0.8 have a vulnerability allowing any authenticated user to manage object storage via unprotected API endpoints. This flaw enables low-privilege or self-registered users to manipulate storage objects, including listing files, obtaining pre-signed download URLs for other users' files, deleting objects, and uploading data at arbitrary locations. By exploiting this vulnerability, unauthorized actions can compromise data security and integrity.

Affected Version(s)

MateCloud 0 <= 5.0.8

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/matecloud-stora...
third-party-advisory
https://github.com/mateaix/matecloud/blob/57b1edc0f0b8b96...
technical-description
https://github.com/mateaix/matecloud/blob/57b1edc0f0b8b96...
technical-description

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.