{"id":"CVE-2026-114261","kind":"vulnerability","aliases":["CVE-2026-114261"],"related":[],"title":"MomoTommy file-management-system: Files API lacks authentication, remote file access","description":"A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files API. The manipulation of the argument Request results in missing authentication. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.","summary":"MomoTommy/file-management-system (a Laravel app) registers its /api/files resource without auth:sanctum, so anyone who can reach it can list, upload, rename and delete files with no login. A public PoC is in the project's issue tracker; the maintainer has not responded and no fix exists.","severity":"high","cvss":7.5,"epss":0.00514,"exploited":false,"exploited_at":null,"products":[{"name":"MomoTommy/file-management-system","fixed":[],"affected":"commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df (only commit; no versioning)","ecosystem":"github"}],"ecosystems":[],"tags":["file-management","laravel","no-fix","package","php","self-hosted"],"not_affected_if":["auth-middleware-added","auth-required","not-exposed-to-network"],"how_to_check":"- In routes/api.php, check whether Route::apiResource('files', FileController::class) sits outside an auth:sanctum middleware group (run: php artisan route:list --path=api/files and look for no auth middleware).\n- From outside, run: curl -i http://HOST/api/files . A 200 with JSON means exposed; 401 means protected.","fix":"No fixed version or commit exists; project is unresponsive. Workaround: wrap Route::apiResource('files', FileController::class) in Route::middleware('auth:sanctum')->group(...) in routes/api.php, add authorization/ownership checks in FileController, or block /api/files at the web server until then.","status":"open","published_at":"2026-10-21T17:18:26+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:35+00:00","updated_at":"2026-10-25T03:22:50+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-25T03:16:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MomoTommy file-management-system: Files API lacks authentication, remote file access","impact":"high","summary":"The file-management-system project has a Files API in FileController.php whose index, store, update and destroy actions do not require authentication. A remote attacker who can reach the API can list, create, change or delete files without logging in.","category":"package","nicknames":[],"who_cares":["php","self-hosted","file-management"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote users read, change or delete files without logging in.","analyst_note":"Find out whether the project has released a fix or a newer commit, and confirm the affected routes at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-114261).","how_to_check":"- Check whether the deployed copy contains `app/Http/Controllers/FileController.php` and whether its index/store/update/destroy methods run without an auth middleware or policy check.\n- Send an unauthenticated request to the Files API routes (for example `GET /api/files` or the equivalent route in `routes/api.php`) and see whether it returns data.","needs_analyst":true,"not_affected_if":["auth-required","not-exposed-to-network"],"who_is_affected":"Teams running the MomoTommy file-management-system code from the affected commit (dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) with the Files API reachable over the network. The project does not use versioning, so affected releases are unknown. Deployments that keep the Files API behind a working login or are not exposed to the network are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000641,"input_tokens":3456,"output_tokens":591,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find out whether the project has released a fix or a newer commit, and confirm the affected routes at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-114261).","search":"'-114261':15A,18A '-2026':14A,17A '/api/files':38B 'access':12A 'affect':91C,141C 'anyon':44B 'api':7A,103C 'app':35B 'app/http/controllers/filecontroller.php':98C 'argument':108C 'attack':115C 'auth':41B 'authent':9A,113C 'compon':101C 'could':127C 'cve':13A,16A 'dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df':88C 'delet':54B 'earli':154C 'exist':77B 'exploit':121C 'file':3A,6A,11A,21B,55B,85C,97C,102C 'file-manag':20B 'file-management-system':2A,84C 'fix':26B,76B 'found':81C 'function':93C 'host':31B 'index/store/update/destroy':94C 'inform':139C,150C 'issu':67B,90C,157C 'lack':8A 'laravel':23B,34B 'launch':118C 'list':50B 'login':58B 'made':124C 'maintain':70B 'manag':4A,22B,86C 'manipul':105C 'miss':112C 'momotommi':1A,83C 'momotommy/file-management-system':19A,32B 'no-fix':24B 'packag':27B 'php':28B 'poc':61B 'problem':153C 'product':131C 'project':65B,148C 'public':60B,125C 'reach':47B 'regist':36B 'releas':144C 'remot':10A,119C 'renam':52B 'report':158C 'request':109C 'resourc':39B 'respond':73B,162C 'result':110C 'sanctum':42B 'self':30B 'self-host':29B 'system':5A,87C 'tracker':68B 'unaffect':143C 'unavail':146C 'upload':51B 'use':129C,134C 'version':135C 'vulner':79C 'without':40B 'yet':163C","nicknames":[],"mitigations":[],"who_affected":"Teams running the MomoTommy file-management-system code from the affected commit (dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) with the Files API reachable over the network. The project does not use versioning, so affected releases are unknown. Deployments that keep the Files API behind a working login or are not exposed to the network are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-114261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114261","severity":null,"published_at":"2026-10-21T17:18:26+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114261","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114261","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114261:702","url":null,"severity":null,"published_at":"2026-10-25T03:22:50+00:00","modified_at":"2026-10-25T03:22:50+00:00","first_seen_at":"2026-10-25T03:22:50+00:00","fetched_at":"2026-10-25T03:22:50+00:00","note":"No fix: repo has only the initial commit dc9ce1b, issue #1 (2026-10-07) open with curl repro (public PoC); root cause is routes/api.php registering Route::apiResource('files') without auth:sanctum. NVD page unreadable; confirmed via CVE.org/VulDB. Sibling CVE-2026-114262 (issue #2, upload) is same repo."}],"documents":[{"id":3140,"url":"https://github.com/MomoTommy/file-management-system/issues/1","title":"Issue #1: Missing authentication on /api/files","kind":"issue","source":"analyst","text":"Open issue by ThanatosXingYu, 2026-10-07. routes/api.php registers Route::apiResource('files', FileController::class) without auth:sanctum; index/store/update/destroy unauthenticated. Commit dc9ce1b. Includes curl repro for list/upload/rename/delete.","published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3141,"url":"https://github.com/MomoTommy/file-management-system/commits/main","title":"Commit history: only initial commit dc9ce1b","kind":"other","source":"analyst","text":"Only one commit (dc9ce1b, Aug 8 2024, Initial commit). No fix or newer commit as of 2026-10-25. Issues #1 and #2 open.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3142,"url":"https://vuldb.com/vuln/424693","title":"VulDB 424693","kind":"advisory","source":"analyst","text":"VulDB entry for CVE-2026-114261: rolling release, no version info, exploit available, project informed via issue, no response.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}