{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/matecloud--5.0.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:matecloud:matecloud:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-110108"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MateCloud (\u003c= 5.0.8)"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","web-application","storage-security"],"_cs_type":"advisory","_cs_vendors":["MateCloud"],"content_html":"\u003cp\u003eMateCloud versions up to 5.0.8 are affected by a critical authorization bypass vulnerability (CVE-2026-110108) located within the StorageController component. The vulnerability stems from missing authorization checks on the administrative API endpoints under /api/v1/admin/storage. Any authenticated user, regardless of their privilege level, can invoke these endpoints to interact with the underlying object storage system. This flaw allows unauthorized actors to list buckets, delete objects, upload arbitrary content, and retrieve pre-signed download URLs for files belonging to other users. The exposure of these management functions poses a significant risk to data confidentiality and integrity, as it enables low-privilege accounts to perform actions intended solely for administrative personnel.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthorized users to manipulate object storage environments without administrative rights. This can lead to the exfiltration of sensitive data through pre-signed URL generation, unauthorized deletion of critical assets, and the injection of malicious files into object storage buckets. The vulnerability is applicable to any deployment of MateCloud 5.0.8 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade MateCloud to a patched version once available from the vendor to remediate CVE-2026-110108.\u003c/li\u003e\n\u003cli\u003eMonitor web application access logs for any requests to the /api/v1/admin/storage path originating from non-administrative user accounts.\u003c/li\u003e\n\u003cli\u003eImplement stricter network-level or identity-based access controls for administrative API endpoints to mitigate unauthorized access while awaiting a permanent patch.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T18:37:28Z","date_published":"2026-10-13T18:37:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-matecloud-auth-bypass/","summary":"MateCloud versions 5.0.8 and earlier contain an authorization bypass vulnerability (CVE-2026-110108) allowing authenticated users to perform unauthorized administrative object storage operations.","title":"Authorization Bypass in MateCloud StorageController","url":"https://feed.craftedsignal.io/briefs/2026-10-matecloud-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - MateCloud (\u003c= 5.0.8)","version":"https://jsonfeed.org/version/1.1"}