{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/file-management-system/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:momotommy:file-management-system:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-114261"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["file-management-system"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MomoTommy"],"content_html":"\u003cp\u003eA vulnerability exists in the MomoTommy file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) within the Files API component. Specifically, the 'index', 'store', 'update', and 'destroy' functions in 'app/Http/Controllers/FileController.php' fail to properly validate authentication when specific request arguments are manipulated. This vulnerability allows for unauthenticated remote access to file management operations. As the project does not use formal versioning and has not responded to vulnerability reports, there is no vendor patch available.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eRemote unauthenticated attackers can perform unauthorized file operations, including creating, reading, updating, and deleting files, by bypassing the authentication controls in the Files API.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of MomoTommy file-management-system in the environment.\u003c/li\u003e\n\u003cli\u003eImplement network-level access controls to restrict access to the application to trusted internal segments only.\u003c/li\u003e\n\u003cli\u003eApply WAF rules to inspect HTTP requests directed at the 'app/Http/Controllers/FileController.php' logic if feasible.\u003c/li\u003e\n\u003cli\u003eMonitor application access logs for unexpected access to the Files API endpoints, particularly from unauthorized or external IP addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T19:16:09Z","date_published":"2026-10-21T19:16:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-momo-tommy-auth-bypass/","summary":"A missing authentication vulnerability in the MomoTommy file-management-system Files API allows remote attackers to manipulate request arguments to gain unauthorized access to file operations.","title":"MomoTommy file-management-system: Authentication bypass (CVE-2026-114261)","url":"https://feed.craftedsignal.io/briefs/2026-10-momo-tommy-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - File-Management-System","version":"https://jsonfeed.org/version/1.1"}