CVE-2026-110108 Details

A missing authorization vulnerability has been identified in MateCloud versions through 5.0.8. This vulnerability allows any authenticated user to manage object storage by accessing the unprotected /api/v1/admin/storage endpoints in the StorageController. Low-privilege or self-registered users can manipulate arbitrary bucket and object names to list objects, obtain pre-signed download URLs for files belonging to other users, delete objects, and upload files to specified keys.

Add the @SaCheckLogin and @SaCheckPermission annotations to the StorageController to enforce proper authorization. Additionally, scope the bucket and object names to the authenticated principal to prevent unauthorized access to other users' files. Align the gateway's admin paths with the actual controller paths to ensure consistent authorization enforcement.