MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API

Advisories

MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API

severity: high
date: 10/13/2026
Affecting: MateCloud <= 5.0.8
CVE: CVE-2026-110108
CWE: CWE-862 Missing Authorization
CVSS: 8.6
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/matecloud-storage-admin-missing-authz
https://github.com/mateaix/matecloud/blob/57b1edc0f0b8b964448e2d41ef7ba98751e71d8d/mate-biz/mate-system/src/main/java/vip/mate/system/admin/trigger/controller/StorageController.java#L45-L118
https://github.com/mateaix/matecloud/blob/57b1edc0f0b8b964448e2d41ef7ba98751e71d8d/mate-gateway/src/main/resources/application.yml#L80-L85
https://github.com/mateaix/matecloud
Credit: hieuPenguinnn
Description: MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo