MomoTommy file-management-system: Authentication bypass (CVE-2026-114261)

A vulnerability exists in the MomoTommy file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) within the Files API component. Specifically, the 'index', 'store', 'update', and 'destroy' functions in 'app/Http/Controllers/FileController.php' fail to properly validate authentication when specific request arguments are manipulated. This vulnerability allows for unauthenticated remote access to file management operations. As the project does not use formal versioning and has not responded to vulnerability reports, there is no vendor patch available.

Impact

Remote unauthenticated attackers can perform unauthorized file operations, including creating, reading, updating, and deleting files, by bypassing the authentication controls in the Files API.

Recommendation

• Identify all instances of MomoTommy file-management-system in the environment.
• Implement network-level access controls to restrict access to the application to trusted internal segments only.
• Apply WAF rules to inspect HTTP requests directed at the 'app/Http/Controllers/FileController.php' logic if feasible.
• Monitor application access logs for unexpected access to the Files API endpoints, particularly from unauthorized or external IP addresses.