MateCloud: Missing authorization in storage admin API

Summary

MateCloud through 5.0.8 does not enforce authorization on the /api/v1/admin/storage endpoints of StorageController. Any authenticated user, including self-registered accounts, can list objects, generate pre-signed download URLs for other users' files, delete objects and upload files to chosen keys.

Affected

• mateaix MateCloud, versions 0 to and including 5.0.8
• Default configuration is listed as unaffected by the CNA; the affected configuration is not further specified.

Fixed in

• Unknown. No vendor advisory or confirmed fixed release found.
• A commit (57b1edc0f0b8b964448e2d41ef7ba98751e71d8d) is listed as a fix by OSV but is also cited as the vulnerable code reference; this is unverified.

Workaround

• No vendor-published workaround.
• Restrict external access to /api/v1/admin/storage at the reverse proxy or gateway to admin roles or internal networks.
• Disable self-registration if enabled.
• Review object storage bucket policies and credentials.

Exploitation

• No known exploitation in the wild found; CISA KEV not verified.
• No public proof of concept found.
• CISA SSVC: exploitation none, not automatable, partial technical impact.

Our recommendation

• Check whether MateCloud or a derivative is deployed in your environment or in customer-built applications.
• Ask mateaix which commit or release fixes the issue and verify the StorageController code yourself.
• Until fixed, block external access to the storage admin endpoints and disable open self-registration.
• Review object storage access logs for unexpected list, download, delete or upload activity.
• Apply the vendor fix as soon as it is confirmed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MateCloud GitHub repository github.com
• StorageController.java at vulnerable commit github.com
• VulnCheck advisory www.vulncheck.com
• HackMD write-up hackmd.io
• OSV CVE-2026-110108 osv.dev
• VulDB 417831 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:27.