An authorization bypass vulnerability in dromara lamp-cloud allows any authenticated user to download files belonging to other users, leading to unauthorized sensitive data exposure.

This is a Broken Object Level Authorization (BOLA) flaw (CWE-639) located in the FileAnyoneController. The application fails to validate file ownership against the creator identity when processing requests to the /anyone/file/down and /anyone/file/download endpoints, allowing any authenticated user to access arbitrary files by supplying the corresponding identifier.

Successful exploitation of this vulnerability enables unauthorized access to sensitive documents, private user data, and potentially proprietary information stored within the platform. Given the CVSS score of 6.5, the risk is significant due to the potential for large-scale data exfiltration and the compromise of confidentiality for all users of the system.

Immediate Action: Update dromara lamp-cloud to the latest version, as the vendor has addressed this flaw by implementing proper ownership validation checks in the file download controllers.

Proactive Monitoring: Review web server and application access logs for anomalous patterns, specifically looking for high volumes of GET requests to the /anyone/file/ endpoints originating from a single user account.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to inspect and restrict access to sensitive file-downloading parameters, or implement strict API gateway controls to enforce authorization checks if an immediate upgrade is not feasible.

Public Exploit Available: Yes — a proof-of-concept script has been published on GitHub.

The severity of this vulnerability is elevated by the presence of a functional proof-of-concept, which lowers the barrier for attackers to exfiltrate data. Security teams must prioritize patching this component immediately to ensure that file access controls are correctly enforced and to prevent unauthorized data exposure.