Authorization Bypass in MateCloud StorageController

MateCloud versions up to 5.0.8 are affected by a critical authorization bypass vulnerability (CVE-2026-110108) located within the StorageController component. The vulnerability stems from missing authorization checks on the administrative API endpoints under /api/v1/admin/storage. Any authenticated user, regardless of their privilege level, can invoke these endpoints to interact with the underlying object storage system. This flaw allows unauthorized actors to list buckets, delete objects, upload arbitrary content, and retrieve pre-signed download URLs for files belonging to other users. The exposure of these management functions poses a significant risk to data confidentiality and integrity, as it enables low-privilege accounts to perform actions intended solely for administrative personnel.

Impact

Successful exploitation of this vulnerability allows unauthorized users to manipulate object storage environments without administrative rights. This can lead to the exfiltration of sensitive data through pre-signed URL generation, unauthorized deletion of critical assets, and the injection of malicious files into object storage buckets. The vulnerability is applicable to any deployment of MateCloud 5.0.8 or earlier.

Recommendation

• Upgrade MateCloud to a patched version once available from the vendor to remediate CVE-2026-110108.
• Monitor web application access logs for any requests to the /api/v1/admin/storage path originating from non-administrative user accounts.
• Implement stricter network-level or identity-based access controls for administrative API endpoints to mitigate unauthorized access while awaiting a permanent patch.